WO2023246501A1

WO2023246501A1 - Message verification method and apparatus, and related device and storage medium

Info

Publication number: WO2023246501A1
Application number: PCT/CN2023/098576
Authority: WO
Inventors: 杨锋; 程伟强
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2022-06-21
Filing date: 2023-06-06
Publication date: 2023-12-28
Also published as: CN117318947A

Abstract

Disclosed in the present application are a message verification method and apparatus, and a related device and a storage medium. The method comprises: a first node verifying a first message on the basis of a first data table, wherein the first data table takes a token as an index, and stores first information corresponding to each message forwarding path among at least one message forwarding path; and the token is obtained by means of performing mapping on the basis of a corresponding message forwarding path.

Description

Message verification methods, devices, related equipment and storage media

Application cross-reference

This application is based on a Chinese patent application with application number 202210705160.0 and a filing date of June 21, 2022, and claims the priority of the above-mentioned Chinese patent application. The entire content of the above-mentioned Chinese patent application is hereby incorporated into this application as a reference.

Technical field

The present application relates to the field of communication technology, and in particular to a message verification method, device, related equipment and storage medium.

Background technique

Among related technologies, the Software Defined Wide Area Network (SD-WAN) based on the segment routing (SRv6, Segment Routing IPv6) of the Internet Protocol Version 6 (IPv6, Internet Protocol Version 6) has network security risks.

Contents of the invention

In order to solve related technical problems, embodiments of the present application provide a message verification method, device, related equipment and storage medium.

The technical solution of the embodiment of this application is implemented as follows:

Embodiments of this application provide a message verification method, applied to the first node. The method includes:

Based on the first data table, verify the first message; where,

The first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on mapping of the corresponding message forwarding path.

The embodiment of the present application also provides a message verification method, which is applied to customer terminal equipment (CPE, Customer Premise Equipment). The method includes:

Send the first message to the first node; where,

The first node includes provider edge equipment and/or (PE, Provider Edge) equipment or point-of-presence (PoP, point-of-presence), and is used to verify the first message based on the first data table; The first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on mapping of the corresponding message forwarding path.

Embodiments of this application also provide a message verification method, which is applied to Border Gateway Protocol (BGP, Border Gateway Protocol) equipment. The method includes:

Send the second information to the first node; where,

The second information includes a second token and a segment list of the second message; the second information is used for the first node to write the first information corresponding to the message forwarding path of the second message into the first node. a data table;

The first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path;

The first information corresponding to the message forwarding path of the second message is indexed in the first data table with the second token; the first information corresponding to the message forwarding path of the second message Determined by the segment list of the second message.

The embodiment of the present application also provides a message verification device, including:

The verification unit is configured to verify the first message based on the first data table; wherein,

The first sending unit is configured to send the first message to the first node; wherein,

The first node includes a PE device or PoP, which is used to verify the first message based on a first data table; the first data table uses a token as an index and stores each message in at least one message forwarding path. The first information corresponding to the message forwarding path; the token is mapped based on the corresponding message forwarding path.

The second sending unit is configured to send the second information to the first node; wherein,

An embodiment of the present application also provides a network device, including a first processor and a first communication interface, wherein,

The first processor is configured to verify the first message based on the first data table; wherein,

An embodiment of the present application also provides a client terminal device, including a second processor and a second communication interface, wherein:

The second communication interface is configured to send the first message to the first node; wherein,

An embodiment of the present application also provides a network device, including a third processor and a third communication interface, wherein:

The third communication interface is configured to deliver the second information to the first node; wherein,

An embodiment of the present application also provides a network device, including a first processor and a first memory for storing a computer program capable of running on the first processor,

Wherein, the first processor is configured to execute the steps of any one of the methods on the first node side when running the computer program.

An embodiment of the present application also provides a client terminal device, including a second processor and a second memory for storing a computer program capable of running on the second processor,

Wherein, the second processor is configured to execute the steps of any one of the methods on the CPE side when running the computer program.

An embodiment of the present application also provides a network device, including a third processor and a third memory for storing a computer program capable of running on the third processor,

Wherein, the third processor is configured to execute the steps of any one of the methods on the BGP device side when running the computer program.

Embodiments of the present application also provide a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods on the first node side are implemented, or any one of the methods on the CPE side is implemented. The steps of the method described in the above item, or the steps of implementing any of the methods described in the above BGP device side.

In the message verification method, device, related equipment and storage medium provided by the embodiments of this application, the CPE sends the first message to the first node, and the first node verifies the first message based on the first data table; wherein , the first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path. In the above scheme, each first node can verify the legitimacy of the received first message based on the first data table, thereby reducing network security risks, and the first data table uses tokens as indexes, which can reduce the risk of the first data Table maintenance difficulty. The first node can query the first information corresponding to each forwarding path in the first data table based on the token. It does not need to use segment identifiers (SID, Segment Identify) to retrieve or compare path information, which can reduce the amount of calculations. and save query time, thereby reducing the difficulty of hardware deployment.

Description of the drawings

Figure 1 is a schematic structural diagram of SID in related technologies;

Figure 2 is a schematic structural diagram of SRH in related technology;

Figure 3 is a schematic diagram of network architecture in related technologies;

Figure 4 is a schematic flow chart of the implementation of a message verification method according to an embodiment of the present application;

Figure 5 is a schematic diagram of a message verification method according to an embodiment of the present application;

Figure 6 is a schematic diagram of a message forwarding method according to an embodiment of the present application;

Figure 7 is a schematic flow chart of the implementation of a message verification method according to an embodiment of the present application;

Figure 8 is a schematic flow chart of the implementation of a message verification method according to an embodiment of the present application;

Figure 9 is a schematic diagram of the interaction flow of a message verification method according to an embodiment of the present application;

Figure 10 is a schematic structural diagram of a message verification device according to an embodiment of the present application;

Figure 11 is a schematic structural diagram of a message verification device according to an embodiment of the present application;

Figure 12 is a schematic structural diagram of a message verification device according to an embodiment of the present application;

Figure 13 is a schematic structural diagram of a network device according to an embodiment of the present application;

Figure 14 is a schematic structural diagram of a client terminal device according to an embodiment of the present application;

Figure 15 is a schematic structural diagram of a network device according to an embodiment of the present application.

Detailed ways

Before introducing the embodiments of this application, related technologies will be described first:

Segment Routing (SR, Segment Routing) is a source routing technology that allocates segments to nodes, links or business functions in the network, and combines these segments on demand at the head node to form an encapsulated message. The Segment sequence in the header, that is, the segment list (segmentlist). When the packet reaches the entrance of the SR domain, it can be pushed into the Segment sequence according to the requirements, and the packet is guided to the corresponding node, link or service function in turn according to the instructions of the Segment in the Segment sequence.

The advantages of SR can be summarized in four aspects:

Control protocol simplification: SR distributes SIDs through Interior Gateway Protocol (IGP, Interior Gateway Protocol) and BGP, without the need to deploy and maintain traditional label distribution protocol (LDP, label distribution protocol), based on the traffic engineering extended resource reservation protocol (RSVP- TE, Resource ReSerVation Protocol-Traffic Engineering), etc.

High scalability: SR generates massive SR paths by combining limited links and node segments, and path information only needs to be saved at the head node, and intermediate nodes in the network do not need to maintain path status information.

Programmability: In the SR technology system, segments can be regarded as instructions. The combination of segments to form an SR path that meets specific needs can be regarded as programming the network. This kind of programming can flexibly establish paths that meet different needs and unlock the value of the network.

High reliability protection: SR can provide 100% network coverage Fast Re-Route protection, which solves the long-term technical problems faced by Internet Protocol (IP, Internet Protocol) networks and can achieve high scalability. Complete reliability protection.

SRv6 is an SR source routing technology based on IPv6. The length of the SRv6 SID is 128 bits, which is consistent with the IPv6 address. As shown in Figure 1, the SID format usually consists of three parts, including locator (Locator), function (Function) and optional parameters (Argument).

Among them: Locator is an identifier assigned to a network node and is used for routing and forwarding data packets. In SRv6SID, the Locator is a variable-length part used to adapt to networks of different sizes. Locator identifiers have two important properties: routable and aggregable.

Function is used to express the forwarding action to be executed by the instruction, which is equivalent to the operation code of the computer instruction. In SRv6 network programming, different forwarding behaviors are expressed by different Functions.

Argument is an optional field used to carry parameters required when executing instructions. These parameters may contain streams, services, or any other relevant information.

Through the above definition of the SRv6SID format, SRv6SID can be used to flexibly indicate various operations and parameters in the network.

On the other hand, SRv6 introduces a new SRH in the routing extension header of IPv6, which is used to carry the sequence of SRv6 SID to realize flexible programming of SRv6 network paths and various functions. SRH can also include an optional TLV (Type-length-value) field to carry variable-length data, providing better scalability for SRv6. The format of SRH is shown in Figure 2.

While inheriting all the advantages of SR, SRv6 has gained stronger scalability and programmability through combination with IPv6, and has unique advantages in network simplification and meeting new business requirements. In SD-WAN based on SRv6, because SR source routing technology encodes all network information into packets, all path information is carried in packets initiated by the user side, and path information is not constrained, causing users to The control rights are too large; when the SRv6 network extends to untrusted user sides, there is a hidden danger of users calling network resources without authorization. As shown in Figure 3, for example, in the cloud migration scenario, the CPE is located in an untrusted domain. By specifying the path in the packet, users can not only access their own private network in the cloud (VPC, Virtual Private Cloud), but also illegally access other Users' VPC brings network security risks.

In response to the problem that users have too much control rights and network security risks exist in SD-WAN based on SRv6, the following three schemes for verifying packets have been proposed in related technologies:

Solution 1: Hop-by-hop verification

The standard recommends using a key-related hash operation message authentication code (HMAC, Hash-based Message Authentication Code) to verify the legal SRv6 path, but it is difficult to implement. The reason is: the current router hardware does not support HMAC calculation, and the hardware needs to be upgraded, which is costly; the huge amount of calculations brought by the router for HMAC verification will seriously affect the forwarding efficiency.

Option 2: Entrance inspection

Access control lists (ACLs) can be used to match and filter traffic. However, the length of the SID list (List) is not fixed, and ACL resource consumption is large, making it not suitable for large-scale deployment; ACL needs to match the SID list, which is difficult to maintain. , difficult to put into use.

Option 3: Testing at both ends

Unauthorized access can be prevented by verifying messages at both ends of the CPE and PoP. However, when a Distributed Denial of Service (DDoS) attack occurs, since the intermediate node does not verify the received message, it still cannot Block DDoS attacks.

Path verification needs to support flexible hop-by-hop, head-to-tail, or arbitrary node combination verification to reduce the difficulty of hardware deployment and implementation.

Based on this, in various embodiments of the present application, the CPE sends the first message to the first node, and the first node verifies the first message based on the first data table; wherein the first data table uses a token as The index stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path. In the above scheme, each first node can verify the legitimacy of the received first message based on the first data table, thereby reducing network security risks, and the first data table uses tokens as indexes, which can reduce the risk of the first data Table maintenance difficulty. The first node can query the first information corresponding to each forwarding path in the first data table based on the token. It does not need to use SID to retrieve or compare path information, which can reduce the computational load and save query time, thereby reducing Hardware deployment is difficult to implement.

The present application will be described in further detail below in conjunction with the accompanying drawings and embodiments.

The embodiment of the present application provides a message verification method, which is applied to the first node. The first node may be a router or a virtual routing device. Wherein, the first node includes PE equipment and/or PoP. Referring to Figure 4, the method includes:

Step 401: Verify the first message based on the first data table.

Wherein, the first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path.

Here, the first data table is stored in the first node, and different first nodes store different first data tables. When receiving the first message, the first node verifies the first message based on the first data table and obtains the verification result of the first message. For example, based on the token in the first data table and/or the first information indexed by the corresponding token, the first message is verified to obtain the verification result of the first message.

The first message may be sent by the CPE or by other first nodes. When the verification result indicates that the verification is successful, indicating that the first message is legal, the first node forwards the first message based on the next hop (NH, Next Hop) address of the first message; in the verification result If the verification fails, the first message is illegal and the first node discards the first message. The next hop address can be the next hop SID.

The first data table is also called a legal path verification table. The first information is legal path information corresponding to the first node. Each token corresponds to a message forwarding path, and the token and the corresponding first information are associated and stored in the first data table. The token can be a hash value calculated based on the packet forwarding path, or it can be a random number assigned to the corresponding packet forwarding path.

It should be noted that the first node can enable the message verification function by default, or can enable the message verification function according to actual needs. verification function, or turn off the message verification function. When the message verification function is enabled or enabled, the first node verifies the first message based on the first data table.

In order to improve the credibility of the message verification results and thereby reduce network security risks, in one embodiment, the first information includes at least one of the following:

The corresponding ingress interface number of the corresponding packet forwarding path at the first node;

The corresponding message forwarding path is at the next hop address corresponding to the first node.

Here, in the first data table, the next hop address may be marked as NH, and the ingress interface number may be marked as IngIF. The ingress interface number represents the ingress interface information of the tunnel. The tunnel can be an Internet Security Protocol (IPSec, Internet Protocol Security) tunnel, or a Generic Routing Encapsulation (GRE, Generic Routing Encapsulation) tunnel.

The incoming interface number in the first information is used to verify the incoming interface number in the first message when the incoming interface of the first node is a tunnel.

The next hop address in the first information is used to verify the next hop address in the first message. The next hop address in the first message refers to the next hop address corresponding to the first node in the first message. .

Considering that when the first node forwards user packets containing illegal path information, it may cause the corresponding user to illegally enter the VPC of other users, thereby causing network security risks, such as data leakage. Based on this, in order to reduce network security risks, in the implementation In the example, the method also includes:

If the verification result of the first message meets at least one of the following conditions, the first message is discarded:

The first message does not carry a token;

The first message carries a first token, and the first token does not exist in the first data table;

The first packet carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents The ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

The first packet carries a first token, the first token exists in the first data table, and the first next hop address does not match the second next hop address; the first next hop address The hop address represents the next hop address in the first information indexed by the first token; the second next hop address represents the next hop address of the first message corresponding to the first node. .

Here, the first node supports the first verification mode and the second verification mode. The first node determines which verification mode is currently used to verify the first message according to the configuration information. The first verification mode is also called the source routing path mode, and the second verification mode is also called the non-source routing path mode. In the first verification mode, the first node verifies the first message based on the token corresponding to the corresponding message forwarding path in the first data table, and the next hop address and/or ingress interface number. In the second verification mode, the first node verifies the first message based on the token corresponding to the corresponding message forwarding path in the first data table.

In the first verification mode, if the verification result of the first message meets at least one of the following conditions, the first message is indicated as an illegal message and the first message is discarded:

The first message does not carry the token;

The first message carries the first token, and the first token does not exist in the first data table;

The first packet carries the first token, the first token exists in the first data table, and the first inbound interface number does not match the second inbound interface number; the first inbound interface number represents the index indexed by the first token. The ingress interface number in the first information; the second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

The first packet carries the first token, the first token exists in the first data table, and the first next hop address does not match the second next hop address; the first next hop address is represented by the first token The next hop address in the indexed first information; the second next hop address represents the next hop address corresponding to the first message at the first node.

For example, in the first verification mode, the first node detects whether the first message carries a token, and if the first message does not carry the token, discards the first message.

When the first message carries a token, the first node extracts the first token from the first message, and extracts the first token from the first message. The second inbound interface number and/or the second next hop address are extracted from one packet. As shown in Figure 5, the second next hop address can be based on the pointer (SL, Segment Left) carried in the first packet. and the segment list in the first message. SL is used to indicate the currently active Segment. The first node obtains the currently active SID from the SL. Based on the currently active SID, it determines the next hop SID from the segment list in the first message.

The first node queries the first data table for the first token; if the first token is not found in the first data table, the first node discards the first message. When the first token is queried in the first data table, the first information indexed by the first token is determined in the first data table, and the ingress interface number is obtained from the determined first information. and/or the next hop address to obtain the first inbound interface number and/or the first next hop address; compare the first inbound interface number and the second inbound interface number, and/or compare the first next hop address and The second next hop address; when the comparison result represents that the first inlet interface number and the second ingress interface number do not match (are different), and/or, when the comparison result represents the first next hop address and the second next hop address If the hop address does not match, the first packet is discarded.

The first packet carries the first token, the first token exists in the first data table, and the first inbound interface number matches the second inbound interface number, and/or the first next hop address matches the second inbound interface number. When the one-hop address matches, it indicates that the first message is a legitimate message, and the first node forwards the first message based on the first next-hop address or the second next-hop address.

Figure 6 shows a schematic diagram of a message forwarding method according to an embodiment of the present application. In Figure 6, a message verification process in a dotted box is added based on related technologies. In actual application, as shown in the dotted box in Figure 6, the first node extracts the first token and next hop address (NH SID) from the SRH in the first message, and extracts the incoming interface from the first message. (IngIF), and query the first token in the first data table; if the first token is not found in the first data table, discard the first message; query the first token in the first data table In the case of one token, obtain the IngIF and NH SID in the first information indexed by the first token in the first data table;

In the case where the IngIF obtained from the first data table is different from the IngIF in the first message, and/or the NH SID obtained from the first data table is different from the NH SID in the first message, Discard the first packet. When the IngIF obtained from the first data table is the same as the IngIF in the first message, and the NH SID obtained from the first data table is the same as the NH SID in the first message, based on the first The first message is forwarded based on the NH SID of the message.

In the second verification mode, if the verification result of the first message meets at least one of the following conditions, the first message is indicated as an illegal message and the first message is discarded:

The first message does not carry the token;

The first message carries the first token, and the first token does not exist in the first data table.

For example, in the second verification mode, the first node detects whether the first message carries a token, and if the first message does not carry a token, discards the first message. When the first message carries a token, the first token is extracted from the first message, and the first token is queried in the first data table. The first token is not queried in the first data table. In the case of a card, the first packet is discarded. When the first token is found in the first data table, the first message is forwarded based on the second next hop address in the first message.

Before verifying the next hop address in the first message, the first node needs to obtain the next hop address of the first message from the first data table. Based on this, in one embodiment, the method further includes :

Based on the first token carried in the first message, the next hop address of the first message is determined in the first data table; wherein,

The next hop address of the first message is the next hop address in the first information indexed by the first token.

Here, the first node extracts the first token from the first message, queries the first information corresponding to the first token in the first data table based on the first token carried in the first message, and retrieves the first token from the first data table. The next hop address is determined from the first information received, and the next hop address of the first message is obtained.

In an embodiment, the first token is mapped from the segment list of the first message.

Here, the packet forwarding path of the first packet is the segment list, and the first token is a hash value calculated based on the segment list of the first packet, or the first token is the segment list of the first packet. The random number assigned.

In one embodiment, the first token carried in the first message is encapsulated in a Segment Routing Header (SRH) of the first message.

Here, the first node extracts the first token from the SRH of the first message.

The data in the first data table is dynamically updated. Based on this, in one embodiment, the method further includes:

Receive the second information sent by the BGP device; the second information includes the second token and the segment list of the second message;

Write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

Here, BGP devices include SD-WAN controllers and/or cloud private network controllers. In actual application, when the first node is a PE device or PoP, the BGP device is the cloud private network controller.

The first node receives the second information delivered by the BGP device, and determines the first information corresponding to the packet forwarding path of the second packet based on the segment list of the second packet included in the second information; The first information corresponding to the packet forwarding path is written into the first data table. Wherein, the first information at least includes the second token, and may also include the ingress interface number and/or next hop address corresponding to the packet forwarding path of the second packet at the first node.

It should be noted that the first information corresponding to the packet forwarding path of the first packet in the first data table is also determined based on the first token issued by the BGP device and the segment list of the first packet.

Correspondingly, the embodiment of this application also provides a message verification method, which is applied to CPE. Referring to Figure 7, the method includes:

Step 701: Send the first message to the first node.

Wherein, the first node includes a PE device or PoP, which is used to verify the first message based on a first data table; the first data table uses a token as an index and stores at least one message forwarding path. The first information corresponding to each message forwarding path; the token is mapped based on the corresponding message forwarding path.

Here, the CPE encapsulates the first message and sends the first message to the first node.

Exemplarily, the method for the CPE to encapsulate the first message may be: the CPE receives the first token of the first message and the source path (SR) of the first message delivered by the BGP device (for example, SD-WAN controller). Policy), the SR Policy includes the segment list of the first message; the first message is encapsulated based on the first token of the first message and the segment list of the first message.

In one embodiment, the first information includes at least one of the following:

In one embodiment, the first message carries at least a first token and also carries a second inbound interface number and/or SL; wherein,

The second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

The SL is used for the first node to determine a second next hop address; the second next hop address represents the next hop address corresponding to the first message at the first node.

Since the SL is used to indicate the currently active Segment, the first node can determine the second next hop address based on the SL and the segment list carried in the first message.

In one embodiment, the first token is encapsulated in the SRH of the first message.

Correspondingly, in order to update the data in the first data table, embodiments of the present application also provide a message verification method, which is applied to BGP equipment. The BGP equipment is an SD-WAN controller or a cloud private network controller. Referring to Figure 8, the method includes:

Step 801: Send the second information to the first node.

Wherein, the second information includes a second token and a segment list of the second message; the second information is used for the The first node writes the first information corresponding to the packet forwarding path of the second packet into the first data table;

Here, the BGP device determines the second information and sends the second information to the first node. The first data table is used for the first node to verify the validity of the received message.

In an embodiment, the first node includes PE equipment and/or PoP.

In one embodiment, the first information includes one of the following:

In one embodiment, the method further includes:

Deliver the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

Here, the BGP device delivers the second information to the CPE, so that the CPE encapsulates the second message based on the second token and the segment list of the second message.

The following further describes the embodiments of the present application in conjunction with the interaction flow diagram.

The message verification method shown in Figure 9 includes:

Step 1: The CPE sends the first message to the first node.

Wherein, the first node includes PE equipment or PoP. The CPE may directly or indirectly send the first message to the first node. For example, as shown in Figure 5, the CPE directly sends the first message to the PE device, or the CPE sends the first message to the PoP through the PE device.

In one embodiment, the first packet carries at least the first token and also carries the second inbound interface number and/or SL; wherein,

The second ingress interface number represents the ingress interface number corresponding to the first packet at the first node;

SL is used for the first node to determine the second next hop address; the second next hop address represents the next hop address corresponding to the first message at the first node.

The first token is mapped from the segment list of the first message; the first token is encapsulated in the SRH of the first message.

Step 2: The first node verifies the first message based on the first data table.

The first data table uses the token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is mapped based on the corresponding packet forwarding path.

In an embodiment, the first information includes at least one of the following:

The ingress interface number corresponding to the corresponding packet forwarding path on the first node;

The corresponding packet forwarding path is the next hop address corresponding to the first node.

Here, as shown in Figure 5, the token and the corresponding first information are stored in the first data table in association.

In an embodiment, when the verification result of the first message meets at least one of the following conditions, the first node discards the first message:

The first message does not carry the token;

The first packet carries the first token, the first token exists in the first data table, and the first next hop address is the same as the second next hop address. The one-hop address does not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node. jump address.

The first token is mapped from the segment list of the first message. The first token carried in the first message is encapsulated in the SRH of the first message.

It should be noted that for the implementation process of step 2, please refer to the relevant description in step 401, which will not be described again here.

In an embodiment, the first node further determines the next hop address of the first message in the first data table based on the first token carried in the first message. The next hop address of the first message is the next hop address in the first information indexed by the first token.

Step 3: The BGP device sends the second information to the first node.

The second information includes a second token and a segment list of the second message; the second information is used for the first node to write the first information corresponding to the message forwarding path of the second message into the first data table; The first information corresponding to the message forwarding path of the second message is indexed by the second token in the first data table; the first information corresponding to the message forwarding path of the second message is represented by the segment list of the second message. OK out.

Step 4: The first node receives the second information sent by the BGP device.

Step 5: The first node writes the first information corresponding to the packet forwarding path of the second packet into the first data table.

Wherein, the first information corresponding to the message forwarding path of the second message is indexed by the second token in the first data table; the first information corresponding to the message forwarding path of the second message is indexed by the second message The segment list is determined.

Step 6: The BGP device sends the second information to the CPE.

The second information includes a second token and a segment list of the second message.

Step 7: The CPE receives the second information and encapsulates the second message based on the second information.

Step 8: The CPE sends the second message to the first node.

Step 9: The first node verifies the second message based on the first data table.

Here, the method for verifying the second message by the first node is similar to the method for verifying the first message, and will not be described again here.

Wherein, when the verification result of the second message meets at least one of the following conditions, the first node discards the second message:

The second message does not carry the token;

The second message carries the second token, and the second token does not exist in the first data table;

The second packet carries the second token, the second token exists in the first data table, and the third inbound interface number does not match the fourth inbound interface number; the third inbound interface number represents the index indexed by the second token. The ingress interface number in the first information; the fourth ingress interface number represents the ingress interface number corresponding to the second message at the first node;

The second packet carries the second token, the second token exists in the first data table, and the third next hop address does not match the fourth next hop address; the third next hop address is represented by the second token The next hop address in the indexed first information; the fourth next hop address represents the next hop address corresponding to the first node of the second message.

The second token is mapped from the segment list of the second message. The second token carried in the second message is encapsulated in the SRH of the second message.

In the message verification method, device, related equipment and storage medium provided by the embodiments of this application, the CPE sends the first message to the first node, and the first node verifies the first message based on the first data table; wherein , the first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path. In the above scheme, each first node can verify the legitimacy of the received first message based on the first data table, thereby reducing network security risks, and the first data table uses tokens as indexes, which can reduce the risk of the first data Table maintenance difficulty. The first node can query the first information corresponding to each forwarding path in the first data table based on the token. It does not need to use SID to retrieve or compare path information, which can reduce the computational load and save query time, thereby reducing Hardware deployment is difficult to implement.

In order to implement the message verification method in the embodiment of the present application, the embodiment of the present application also provides a message verification device. Set on the first node, as shown in Figure 10, the device includes:

The verification unit 101 is configured to verify the first message based on the first data table; wherein,

In one embodiment, the device further includes:

A discarding unit configured to discard the first message when the verification result of the first message meets at least one of the following conditions:

The first message does not carry a token;

In one embodiment, the device further includes:

The first determination unit is configured to determine the next hop address of the first message in the first data table based on the first token carried by the first message; wherein the first message The next hop address of is the next hop address in the first information indexed by the first token.

In one embodiment, the first token carried in the first message is encapsulated in the SRH of the first message.

In one embodiment, the device further includes:

The first receiving unit is configured to receive the second information delivered by the BGP device; the second information includes the second token and the segment list of the second message;

A writing unit configured to write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

In an embodiment, the first node includes providing PE equipment and/or PoP.

In actual application, the first receiving unit can be implemented by the processor in the message verification device in combination with the communication interface, and the verification unit 101, the discarding unit, the first determination unit and the writing unit are implemented by the processor of the message verification device.

It should be noted that when the message verification device provided in the above embodiment performs message verification, only the division of the above program modules is used as an example. In actual applications, the above processing can be allocated to different modules as needed. The program module is completed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiment on the first node side belong to the same concept. Please refer to the method embodiment for details of the specific implementation process, which will not be described again here.

In order to implement the message verification method in the embodiment of the present application, the embodiment of the present application also provides a message verification device, which is installed on the CPE. As shown in Figure 11, the device includes:

The first sending unit 111 is configured to send the first message to the first node; wherein,

The first node includes a PE device or a PoP and is configured to verify the first message based on a first data table; the first data table uses a token as an index and stores each message in at least one message forwarding path. The first information corresponding to the message forwarding path; the token is mapped based on the corresponding message forwarding path.

In actual application, the first sending unit 111 can be implemented by a processor in the message verification device combined with a communication interface.

It should be noted that when the message verification device provided in the above embodiment performs message verification, only the division of the above program modules is used as an example. In actual applications, the above processing can be allocated to different modules as needed. The program module is completed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiment on the CPE side belong to the same concept. Please refer to the method embodiment for details of the specific implementation process, which will not be described again here.

In order to implement the message verification method in the embodiment of the present application, the embodiment of the present application also provides a message verification device, which is installed on the BGP device. The BGP device is an SD-WAN controller or a cloud private network controller, such as As shown in Figure 12, the device includes:

The second sending unit 121 is configured to send the second information to the first node; wherein,

In one embodiment, the first information includes one of the following:

In an embodiment, the second sending unit 121 is further configured to: deliver the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

In an embodiment, the first node includes PE equipment and/or PoP.

In actual application, the second sending unit 121 can be implemented by a processor in the message verification device combined with a communication interface.

It should be noted that when the message verification device provided in the above embodiment performs message verification, only the division of the above program modules is used as an example. In actual applications, the above processing can be allocated to different modules as needed. The program module is completed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiment on the BGP device side belong to the same concept. Please refer to the method embodiment for details of the specific implementation process, which will not be described again here.

Based on the hardware implementation of the above program module, and in order to implement the method on the first node side in the embodiment of the present application, the embodiment of the present application also provides a network device. As shown in Figure 13, the network device 13 includes:

The first communication interface 131 is capable of information exchange with other network nodes;

The first processor 132 is connected to the first communication interface 131 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the first node side when running a computer program. The computer program is stored on the first memory 133 .

Specifically, the first processor 132 is configured to verify the first message based on the first data table; wherein,

In an embodiment, the first processor 132 is further configured to discard the first message if the verification result of the first message meets at least one of the following conditions:

The first message does not carry a token;

In an embodiment, the first processor 132 is further configured to: determine the next hop address of the first message in the first data table based on the first token carried in the first message; Wherein, the next hop address of the first message is the next hop address in the first information indexed by the first token.

In one embodiment, the first communication interface 131 is configured to receive the second information delivered by the BGP device; the second information includes a second token and a segment list of the second message;

The first processor 132 is also configured to: write the first information corresponding to the message forwarding path of the second message into the first data table; wherein the first information corresponding to the message forwarding path of the second message is The information is indexed by the second token in the first data table; the first information corresponding to the packet forwarding path of the second packet is determined from the segment list of the second packet.

In an embodiment, the first node includes providing PE equipment and/or PoP.

It should be noted that the specific processing procedures of the first processor 132 and the first communication interface 131 can be understood with reference to the above method.

Of course, in actual application, various components in the network device 13 are coupled together through the bus system 134 . It can be understood that the bus system 134 is used to implement connection communication between these components. In addition to the data bus, the bus system 134 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the various buses are labeled bus system 134 in FIG. 13 .

The first memory 133 in the embodiment of the present application is used to store various types of data to support the operation of the network device 13 . Examples of such data include: any computer program used to operate on the network device 13.

The methods disclosed in the above embodiments of the present application can be applied to the first processor 132 or implemented by the first processor 132 . The first processor 132 may be an integrated circuit chip having signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the first processor 132 . The above-mentioned first processor 132 may be a general-purpose processor, a digital signal Processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 132 can implement or execute the various methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 133. The first processor 132 reads the information in the first memory 133, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the network device 13 may be configured by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs) , Complex Programmable Logic Device), Field-Programmable Gate Array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or other electronics Component implementation, used to execute the aforementioned methods.

Based on the hardware implementation of the above program module, and in order to implement the method on the CPE side in the embodiment of the present application, the embodiment of the present application also provides a client terminal device. As shown in Figure 14, the client terminal device 14 includes:

The second communication interface 141 is capable of information exchange with other network nodes;

The second processor 142 is connected to the second communication interface 141 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the CPE side when running a computer program. The computer program is stored on the second memory 143 .

Specifically, the second communication interface 141 is configured to send the first message to the first node; wherein,

It should be noted that the specific processing procedures of the second processor 142 and the second communication interface 141 can be understood with reference to the above method.

Of course, in actual application, various components in the customer terminal device 14 are coupled together through the bus system 144 . It can be understood that the bus system 144 is used to implement connection communication between these components. In addition to the data bus, the bus system 144 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the various buses are labeled bus system 144 in FIG. 14 .

The second memory 143 in the embodiment of the present application is used to store various types of data to support the operation of the client terminal device 14 . Examples of such data include: any computer program for operation on the client terminal device 14.

The methods disclosed in the above embodiments of the present application can be applied to the second processor 142 or implemented by the second processor 142 . The second processor 142 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the second processor 142 . The above-mentioned second processor 142 may be a general-purpose processor, a DSP, or or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 142 can implement or execute the various methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the second memory 143. The second processor 142 reads the information in the second memory 143, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the client terminal device 14 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.

Based on the hardware implementation of the above program module, and in order to implement the method on the BGP device side of the embodiment of the present application, the embodiment of the present application also provides a network device. As shown in Figure 15, the network device 15 includes:

The third communication interface 151 is capable of information exchange with other network nodes;

The third processor 152 is connected to the third communication interface 151 to implement information interaction with other network nodes, and is used to execute the method provided by one or more technical solutions on the BGP device side when running a computer program. The computer program is stored on the third memory 153 .

Specifically, the third communication interface 151 is configured to deliver the second information to the first node; wherein,

In one embodiment, the first information includes one of the following:

In an embodiment, the third communication interface 151 is further configured to: deliver the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

In an embodiment, the first node includes PE equipment and/or PoP.

It should be noted that the specific processing procedures of the third processor 152 and the third communication interface 151 can be understood with reference to the above method.

Of course, in actual application, various components in the network device 15 are coupled together through the bus system 154 . It can be understood that the bus system 154 is used to implement connection communication between these components. In addition to the data bus, the bus system 154 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the various buses are labeled bus system 154 in FIG. 15 .

The third memory 153 in the embodiment of the present application is used to store various types of data to support the operation of the network device 15 . Examples of such data include: any computer program used to operate on network device 15.

The methods disclosed in the above embodiments of the present application can be applied to the third processor 152 or implemented by the third processor 152 . The third processor 152 may be an integrated circuit chip with signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the third processor 152 . The above-mentioned third processor 152 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The third processor 152 can implement or execute the various methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. Combined with the steps of the methods disclosed in the embodiments of this application, It can be directly implemented by the hardware decoding processor, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the third memory 153. The third processor 152 reads the information in the third memory 153, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the network device 15 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.

It can be understood that the memory (first memory 133, second memory 143, third memory 153) in the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include volatile and non-volatile memories. Both. Among them, non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory). Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory, Magnetic Surface Memory , optical disk, or compact disc (CD-ROM, Compact Disc Read-Only Memory); magnetic surface memory can be disk storage or tape storage. Volatile memory can be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Type Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory) ). The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

In an exemplary embodiment, the embodiment of the present application also provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 133 that stores a computer program. The above computer program can be used by the network device 13 The first processor 132 executes to complete the steps described in the foregoing first node-side method. Another example includes a second memory 143 that stores a computer program. The computer program can be executed by the second processor 142 of the client terminal device 14 to complete the steps of the aforementioned CPE side method. Another example includes a third memory 153 that stores a computer program. The computer program can be executed by the third processor 152 of the network device 15 to complete the steps of the aforementioned BGP device-side method. The computer-readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM and other memories.

It should be noted that "first", "second", etc. are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

The term "and/or" in this article is just an association relationship that describes related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations. In addition, the term "at least one" in this article means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C, which can mean including from A, Any one or more elements selected from the set composed of B and C.

In addition, the technical solutions described in the embodiments of this application can be combined arbitrarily as long as there is no conflict.

The above descriptions are only preferred embodiments of the present application and are not intended to limit the protection scope of the present application.

Claims

A message verification method, applied to the first node, the method includes:

Based on the first data table, verify the first message; where,

The first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on mapping of the corresponding message forwarding path.
The method of claim 1, wherein the first information includes at least one of the following:

The corresponding ingress interface number of the corresponding packet forwarding path at the first node;

The corresponding message forwarding path is at the next hop address corresponding to the first node.
The method of claim 1, further comprising:

If the verification result of the first message meets at least one of the following conditions, the first message is discarded:

The first message does not carry a token;

The first message carries a first token, and the first token does not exist in the first data table;

The first packet carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents The ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

The first packet carries a first token, the first token exists in the first data table, and the first next hop address does not match the second next hop address; the first next hop address The hop address represents the next hop address in the first information indexed by the first token; the second next hop address represents the next hop address of the first message corresponding to the first node. .
The method of claim 1, further comprising:

Based on the first token carried in the first message, the next hop address of the first message is determined in the first data table; wherein,

The next hop address of the first message is the next hop address in the first information indexed by the first token.
The method according to claim 3 or 4, wherein the first token is mapped from the segment list of the first message.
The method according to claim 3 or 4, wherein the first token carried in the first message is encapsulated in the segment routing header SRH of the first message.
The method of claim 1, further comprising:

Receive the second information delivered by the Border Gateway Protocol BGP device; the second information includes a second token and a segment list of the second message;

Write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

The first information corresponding to the message forwarding path of the second message is indexed in the first data table with the second token; the first information corresponding to the message forwarding path of the second message Determined by the segment list of the second message.
The method of claim 1, wherein the first node includes a provider edge PE device and/or a point of presence PoP.
A message verification method, applied to customer terminal equipment CPE, the method includes:

Send the first message to the first node; where,

The first node includes a PE device or PoP, which is used to verify the first message based on a first data table; the first data table uses a token as an index and stores each message in at least one message forwarding path. The first information corresponding to the message forwarding path; the token is mapped based on the corresponding message forwarding path.
The method of claim 9, wherein the first information includes at least one of the following:

The corresponding ingress interface number of the corresponding packet forwarding path at the first node;

The corresponding message forwarding path is at the next hop address corresponding to the first node.
The method according to claim 9 or 10, wherein the first message carries at least a first token and also carries a second inbound interface number and/or pointer SL; wherein,

The second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

The SL is used for the first node to determine a second next hop address; the second next hop address represents the next hop address corresponding to the first message at the first node.
The method according to claim 11, wherein the first token is encapsulated in the SRH of the first message.
A message verification method, applied to BGP equipment, the method includes:

Send the second information to the first node; where,

The second information includes a second token and a segment list of the second message; the second information is used for the first node to write the first information corresponding to the message forwarding path of the second message into the first node. a data table;

The first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path;

The first information corresponding to the message forwarding path of the second message is indexed in the first data table with the second token; the first information corresponding to the message forwarding path of the second message Determined by the segment list of the second message.
The method of claim 13, wherein the first information includes one of the following:

The corresponding ingress interface number of the corresponding packet forwarding path at the first node;

The corresponding message forwarding path is at the next hop address corresponding to the first node.
The method according to claim 13 or 14, wherein the method further includes:

Deliver the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.
The method according to claim 13 or 14, wherein the first node includes a PE device and/or a PoP.
A message verification device, including:

The verification unit is configured to verify the first message based on the first data table; wherein,

The first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on mapping of the corresponding message forwarding path.
A message verification device, including:

The first sending unit is configured to send the first message to the first node; wherein,

The first node includes a PE device or PoP, which is used to verify the first message based on a first data table; the first data table uses a token as an index and stores each message in at least one message forwarding path. The first information corresponding to the message forwarding path; the token is mapped based on the corresponding message forwarding path.
A message verification device, including:

The second sending unit is configured to send the second information to the first node; wherein,

The second information includes a second token and a segment list of the second message; the second information is used for the first node to write the first information corresponding to the message forwarding path of the second message into the first node. a data table;

The first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path;

The first information corresponding to the message forwarding path of the second message is indexed in the first data table with the second token; the first information corresponding to the message forwarding path of the second message Determined by the segment list of the second message.
A network device includes a first processor and a first communication interface, wherein,

The first processor is configured to verify the first message based on the first data table; wherein,

The first data table uses tokens as indexes and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on mapping of the corresponding message forwarding path.
A client terminal device includes a second processor and a second communication interface, wherein,

The second communication interface is configured to send the first message to the first node; wherein,

The first node includes a PE device or PoP, which is used to verify the first message based on a first data table; the first data table uses a token as an index and stores each message in at least one message forwarding path. The first information corresponding to the message forwarding path; the token is mapped based on the corresponding message forwarding path.
A network device includes a third processor and a third communication interface, wherein,

The third communication interface is configured to deliver the second information to the first node; wherein,

The second information includes a second token and a segment list of the second message; the second information is used for the first node to write the first information corresponding to the message forwarding path of the second message into the first node. a data table;

The first data table uses tokens as indexes and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is mapped based on the corresponding message forwarding path;

The first information corresponding to the message forwarding path of the second message is indexed in the first data table with the second token; the first information corresponding to the message forwarding path of the second message Determined by the segment list of the second message.
A network device including a first processor and a first memory for storing a computer program capable of running on the first processor,

Wherein, the first processor is configured to perform the steps of the method according to any one of claims 1 to 8 when running the computer program.
A client terminal device including a second processor and a second memory for storing a computer program capable of running on the second processor,

Wherein, the second processor is configured to perform the steps of the method according to any one of claims 9 to 12 when running the computer program.
A network device including a third processor and a third memory for storing a computer program capable of running on the third processor,

Wherein, the third processor is configured to perform the steps of the method according to any one of claims 13 to 16 when running the computer program.
A storage medium with a computer program stored thereon, which when executed by a processor implements the steps of the method described in any one of claims 1 to 8, or implements the method described in any one of claims 9 to 12 The steps of the method, or the steps of implementing the method of any one of claims 13 to 16.