WO2024094082A1

WO2024094082A1 - Information transmission method and apparatus, node, and storage medium

Info

Publication number: WO2024094082A1
Application number: PCT/CN2023/129156
Authority: WO
Inventors: 陈美玲
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2022-11-03
Filing date: 2023-11-01
Publication date: 2024-05-10
Also published as: CN117998345A

Abstract

Disclosed in embodiments of the present disclosure are an information transmission method and apparatus, a node, and a storage medium. The method comprises: a first node sends first network layer reachability information (NLRI) to a second node, the first NLRI at least comprising first information and/or second information, the first information representing the security capability of the first node, and the second information representing the link association security capability of a link between the first node and the second node.

Description

Information transmission method, device, node and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This disclosure is based on the Chinese patent application with application number 202211370868.1 and application date November 03, 2022, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated into this disclosure by introduction.

Technical Field

The present disclosure relates to the field of communication technology, and in particular to an information transmission method, device, node and storage medium.

Background technique

With the frequent occurrence of network security incidents, users have an increasingly strong demand for network security, and regulators have also put forward corresponding requirements for network security. As a pipeline operator, in addition to ensuring the operational security and route accessibility of the basic network, it is also necessary to provide external secure routing capabilities according to user needs. With the development of programmable networks and Internet Protocol Version 6 (IPv6) Segment Routing (SRv6) technology, the forwarding requirements of the upper layer can be completed through routing programming; the accessibility and security of the routing process can be processed synchronously to provide users with secure routing and secure paths that match their needs.

Currently, there is no effective solution for how to inject security factors into the process of collecting network topology and centralized path calculation, that is, to carry security capability information through routing protocols to achieve secure routing path forwarding.

Summary of the invention

Embodiments of the present disclosure provide an information transmission method, device, node, and storage medium.

The technical solution of the embodiment of the present disclosure is implemented as follows:

In a first aspect, an embodiment of the present disclosure provides an information transmission method, the method comprising:

A first node sends first network layer reachability information (NLRI) to a second node, where the first NLRI includes at least first information and/or second information, where the first information indicates a security capability of the first node, and the second information indicates a link-associated security capability of a link between the first node and the second node.

In some optional embodiments of the present disclosure, the first NLRI is a link NLRI or a type 2 NLRI.

In some optional embodiments of the present disclosure, the first NLRI includes a remote node descriptor field, the remote node descriptor field includes a first attribute, the first attribute is used to represent the security capability of the first node, and the remote node descriptor field includes at least the first information.

In some optional embodiments of the present disclosure, the first NLRI includes a local node descriptor field, the local node descriptor field includes a second attribute, the second attribute is used to represent the security capability of the first node, and the local node descriptor field includes at least the first information.

In some optional embodiments of the present disclosure, the first NLRI includes a link descriptor field, the link descriptor field includes a third attribute, the third attribute is used to indicate a link-associated security capability of the link between the first node and the second node, and the link descriptor field includes at least the second information.

In some optional embodiments of the present disclosure, the method further includes: the first node receiving a second NLRI sent by the second node, the second NLRI including at least third information, and the third information represents the security capability of the second node.

In some optional embodiments of the present disclosure, the method further includes: the first node determining the second information based at least on the security capability of the first node and the security capability of the second node.

In some optional embodiments of the present disclosure, the first node determines the second information based at least on the security capability of the first node and the security capability of the second node, including:

In the case where the first node and the second node are in different security domains, the first node performs a logical AND operation on the security capability of the first node and the security capability of the second node to obtain the link-associated security capability of the link between the first node and the second node; or

When the first node and the second node are in the same security domain, the first node performs a logical OR operation on the security capability of the first node and the security capability of the second node to obtain the link-associated security capability of the link between the first node and the second node.

In a second aspect, an embodiment of the present disclosure further provides an information transmission method, the method comprising:

The second node receives a first NLRI sent by the first node, where the first NLRI includes at least first information and/or second information, where the first information indicates a security capability of the first node, and the second information indicates a link-associated security capability of a link between the first node and the second node.

In some optional embodiments of the present disclosure, the method further includes: the second node at least A link-associated security capability of a link between the second node and the first node is determined based on the security capability of the second node and the security capability of the first node.

In some optional embodiments of the present disclosure, when the second node is connected to the control node, the method further includes:

The second node sends the fourth information and/or the fifth information to the control node, the fourth information represents the security capability of the first node and/or the link-associated security capability of the link between the first node and the second node; the fifth information represents the security capability of the second node and/or the link-associated security capability of the link between the second node and the first node, and the fourth information and/or the fifth information are used by the control node to determine the path information.

In some optional embodiments of the present disclosure, the second node determines, based at least on the security capability of the second node and the security capability of the first node, a link-associated security capability of a link between the second node and the first node, including:

When the first node and the second node are two nodes in different security domains, the second node performs a logical AND operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node; or

When the first node and the second node are two nodes in the same security domain, the second node performs a logical OR operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node.

In some optional embodiments of the present disclosure, the method further includes: the second node sending a second NLRI to the first node, the second NLRI includes at least third information, and the third information indicates the security capability of the second node.

In a third aspect, an embodiment of the present disclosure further provides an information transmission device, which is applied to a first node, and the device includes: a first communication unit, configured to send a first NLRI to a second node, wherein the first NLRI includes at least the first information and/or the second information, and the first information The second information represents the security capability of the first node, and the second information represents the link-associated security capability of the link between the first node and the second node.

In a fourth aspect, an embodiment of the present disclosure further provides an information transmission device, which is applied to a second node, and the device includes: a second communication unit, configured to receive a first NLRI sent by a first node, wherein the first NLRI includes at least first information and/or second information, the first information represents the security capability of the first node, and the second information represents the link-associated security capability of the link between the first node and the second node.

In a fifth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the first aspect or the second aspect of the embodiment of the present disclosure are implemented.

In the sixth aspect, an embodiment of the present disclosure further provides a node, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method described in the first aspect or the second aspect of the embodiment of the present disclosure are implemented.

The information transmission method, device, node and storage medium provided by the embodiment of the present disclosure include: a first node sends a first NLRI to a second node, the first NLRI includes at least first information and/or second information, the first information indicates the security capability of the first node, and the second information indicates the link-associated security capability of the link between the first node and the second node. The technical solution of the embodiment of the present disclosure is adopted to realize the carrying of relevant security capability information through the routing protocol, so that the subsequent controller can decide the routing path according to the relevant security capability information, thereby meeting the security requirements of users in the link forwarding process.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a system architecture of an information transmission method according to an embodiment of the present disclosure;

FIG2 is a schematic diagram of a flow chart of an information transmission method according to an embodiment of the present disclosure;

FIG3 is a schematic diagram of the NLRI format;

FIG4 is a schematic diagram of the format of a field in NLRI;

FIG5 is a second flow chart of the information transmission method according to an embodiment of the present disclosure;

FIG6 is a schematic diagram of a path sending process in the information transmission method according to an embodiment of the present disclosure;

FIG7 is a schematic diagram of the first structure of the information transmission device according to an embodiment of the present disclosure;

FIG8 is a second schematic diagram of the structure of the information transmission device according to an embodiment of the present disclosure;

FIG. 9 is a schematic diagram of the hardware structure of a node according to an embodiment of the present disclosure.

Detailed ways

The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

The technical solutions of the embodiments of the present disclosure can be applied to various communication systems, such as: Global System of Mobile communication (GSM) system, Long Term Evolution (LTE) system or 5G system, etc. Optionally, the 5G system or 5G network can also be called New Radio (NR) system or NR network.

Exemplarily, the communication system applied in the embodiments of the present disclosure may include a network device and a terminal device (also referred to as a terminal, a communication terminal, etc.); the network device may be a device that communicates with the terminal device. Among them, the network device can provide communication coverage within a certain area, and can communicate with terminals located in the area. Optionally, the network device can be a base station in each communication system, such as an evolved base station (eNB, Evolutional Node B) in an LTE system, or a base station (gNB) in a 5G system or an NR system.

It should be understood that the device with communication function in the network/system in the embodiment of the present application can be referred to as a communication device. The communication device may include a network device and a terminal with communication function, and the network device and the terminal device may be the specific devices described above, which will not be repeated here; the communication device may also include other devices in the communication system, such as a network controller, a mobile management entity and other network entities, which are not limited in the embodiments of the present disclosure.

It should be understood that the terms "system" and "network" are often used interchangeably in this article. The term "and/or" in this article is only a description of the association relationship between related objects, indicating that there can be three relationships. For example, A and/or B can mean: A exists alone, A and B exist at the same time, There are three cases of B alone. In addition, the character "/" in this article generally indicates that the objects before and after are in an "or" relationship.

The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, method, system, product or equipment comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

Before describing in detail the information transmission method of the embodiment of the present disclosure, the network protocol used in the embodiment of the present disclosure is briefly described first.

By extending the Border Gateway Protocol (BGP) to carry information such as link status and traffic engineering, the network topology is reported through BGP-LS (BGP Link State). There are currently three types of BGP-LS routes, which are used to carry node, link and route prefix information respectively. The three types of routes work together to complete the transmission of topology information. Among them, the node routing function is to record the node information of the topology, the link routing function is to record the link information between two devices (or nodes), and the address prefix routing function is to record the network segment information reachable by the node.

The NLRI collected through BGP-LS is described in the type/length/value triplet (TLV) format. Each link state described by the NLRI can identify a node, link, or prefix. Therefore, corresponding to the above three types of BGP-LS routes, three types of NLRI are set, as shown in Table 1 below, where type 3 and type 4 are used to distinguish IPv4 and IPv6 prefixes.

Table 1

The embodiments of the present disclosure mainly involve the transmission of information related to security capabilities between nodes, such as the local node obtaining information related to the security capabilities of the peer node, or the local node sending information related to its own security capabilities to the peer node, specifically transmitting information related to security capabilities through a routing protocol. The nodes in the embodiments of the present disclosure can be independent nodes, or can be as shown in FIG1, including a node R and a security product (security products) mounted thereon as a basic unit. For example, the node can be a router, and the security product can be any product with network security functions such as a security component, a firewall, etc., which is not limited in the present embodiment.

In actual applications, some nodes are directly connected to the controller (these nodes are referred to as directly connected nodes), so the nodes can directly transmit node information to the controller through the BGP-LS protocol; while some nodes are not directly connected to the controller (these nodes are referred to as non-directly connected nodes), so the node information needs to be passed to the directly connected nodes to achieve the transmission of node information. Therefore, for non-directly connected nodes, the node-related information needs to be reported through the BGP-LS protocol.

The present disclosure provides an information transmission method. FIG2 is a flow chart of the information transmission method of the present disclosure embodiment; as shown in FIG2 , the method includes:

Step 101: A first node sends a first NLRI to a second node, where the first NLRI includes at least first information and/or second information, where the first information indicates a security capability of the first node, and the second information indicates a link-associated security capability of a link between the first node and the second node.

In this embodiment, the nodes transmit the related information indicating the security capability of the nodes through the BGP-LS protocol. Exemplarily, the NLRI is included in the BGP routing update message.

The first information indicates the security capability of the first node, and the first information may also be referred to as the security capability information of the first node. The second information indicates the link-associated security capability of the link between the first node and the second node, and it can be considered that the second information indicates the security capability of the link between the first node and the second node, the security capability of the first node and/or the second node associated with the link, and the like.

In some optional embodiments of the present disclosure, the first NLRI is a link NLRI (Link NLRI) or a type 2 NLRI (NLRI Type＝2). That is, in this embodiment, the relevant information of the security capability of the node and/or the relevant information of the link-associated security capability is transmitted through the domain or field in the link NLRI (Link NLRI).

For example, FIG3 is a schematic diagram of the NLRI format, specifically a schematic diagram of the Link NLRI format, as shown in FIG3, including a protocol ID field (Protocol-ID), a 64-bit identifier (Identifier) field, a variable length (variable) local node descriptor field (Local Node Descriptors), a variable length (variable) remote node descriptor field (Local Node Descriptors) and a variable length (variable) link descriptor (Link Descriptors) field. Among them,

The Protocol-ID field identifies the type of protocol, as shown in Table 2.

Table 2

The Identifier field identifies the reachable routing scope of the network to which it belongs. NLRI objects (nodes, links, or prefixes) from the same routing scope must have the same "identifier" value.

The Local Node Descriptors field contains the node descriptor of the local end of the anchor link. It is mandatory and of variable length. Its format is shown in Figure 4. The attributes of the Local Node Descriptors field are shown in Table 3.

table 3

Among them, the Node Descriptor Sub-TLVs of the local node descriptor domain records the Node Descriptor Sub-TLV type code point and length, as shown in Table 4 below.

Table 4

The Remote Node Descriptors field contains the node descriptor of the remote end node of the anchor link, and has a variable length. The format of the Remote Node Descriptors field is similar to the format of the Local Node Descriptors field, as shown in Figure 4, or the instructions for deleting the Local Node Descriptors field.

The Link Descriptors field uniquely identifies a link between multiple parallel links between a pair of anchor routers. Examples of its attributes are shown in Table 5.

table 5

Based on this, in this embodiment, a new attribute is added to a specified field in the NLRI, thereby realizing the transmission of the node security capability related information and/or link-associated security capability.

In some optional embodiments, the first NLRI includes a remote node descriptor field, the remote node descriptor field includes a first attribute, the first attribute is used to represent the security capability of the first node, and the remote node descriptor field includes at least the first information.

In this embodiment, the security capability of the node can be represented by the first attribute in the Remote Node Descriptors field in the NLRI. Exemplarily, as shown in Table 6, the security capability of the first node (Node Security Capability) is represented by the attribute corresponding to the newly added TLV code point 1030 (i.e., the first attribute), and it has a variable length.

Table 6

In some other optional embodiments, the first NLRI includes a local node descriptor field, the local node descriptor field includes a second attribute, the second attribute is used to represent the security capability of the first node, and the local node descriptor field includes at least the first information.

In this embodiment, the local node descriptor field (Local Node The second attribute in the TLV Descriptors represents the security capability of the node. Exemplarily, as shown in Table 7, the attribute corresponding to the newly added TLV code point 1030 (ie, the second attribute) represents the security capability of the first node (Node Security Capability), and it has a variable length.

Table 7

The difference between the above two embodiments is whether the first node acts as a local node or a remote node. If the first node acts as a local node, the second method can be used to transmit the security capability of the first node using the second attribute in the local node descriptor field; if the first node acts as a remote node, the first method can be used to transmit the security capability of the first node using the first attribute in the remote node descriptor field. Among them, whether the first node acts as a local node or a remote node can be determined based on whether the relevant information of the first node (such as identification, address, etc.) is filled in the field or field related to the local node (Local Node) or the remote node (Remote Node). If the relevant information of the first node (such as identification, address, etc.) is filled in the field or field related to the local node (Local Node) If the first node is in a domain or field related to a remote node, the first node can be determined to be a local node; if the relevant information of the first node (such as an identifier, an address, etc.) is filled in a domain or field related to a remote node (Remote Node), the first node can be determined to be a remote node.

In some further optional embodiments, the first NLRI includes a link descriptor field, the link descriptor field includes a third attribute, the third attribute is used to indicate a link-associated security capability of the link between the first node and the second node, and the link descriptor field includes at least the second information.

In this embodiment, the link-associated security capability (in this embodiment, the link-associated security capability of the link between the first node and the second node) can be identified by the third attribute in the Link Descriptors field in the NLRI. Exemplarily, as shown in Table 8, the link-associated security capability of the link between the first node and the second node is represented by the attribute corresponding to the newly added TLV code point 1099 (i.e., the third attribute).

Table 8

In this embodiment, the first node may also receive a second NLRI sent by a second node connected thereto, wherein the second NLRI includes at least third information, and the third information indicates the security capability of the second node. The manner in which the third information is carried in the second NLRI may refer to the specific description of the manner in which the first information is carried in the first NLRI, which will not be described in detail here. In other embodiments, the second NLRI may also include information indicating the link-associated security capability of the link between the second node and the first node, and the specific implementation method may refer to the specific description of the second information carried in the first NLRI, which will not be described in detail here.

In this embodiment, the first node can be based on the first node security capability and the second node security The full capabilities determine a link-associated security capability of a link between the first node and the second node.

In some optional embodiments, the first node determines the second information based at least on the security capabilities of the first node and the security capabilities of the second node, including: when the first node and the second node are in different security domains, the first node performs a logical AND operation on the security capabilities of the first node and the security capabilities of the second node to obtain the link-associated security capabilities of the link between the first node and the second node; or, when the first node and the second node are in the same security domain, the first node performs a logical OR operation on the security capabilities of the first node and the security capabilities of the second node to obtain the link-associated security capabilities of the link between the first node and the second node.

In this embodiment, the decision on link-associated security capability is divided into two cases, one case is that the nodes in the link are in the same security domain, and the other case is that the nodes in the link are in different security domains. Exemplarily, the security domain may refer to a security level.

Exemplarily, if SCing represents the security capability that a node has enabled, the security capability of the first node can be expressed as SCing A＝[1,0,0,1,0,……]; the security capability of the second node can be expressed as SCing B＝[1,1,0,1,0,……]; "1" in the above expression can represent the corresponding security capability, and "0" can represent the lack of the corresponding security capability. As an example, if the first node and the second node are in different security domains, the link-associated security capability of the link between the first node and the second node can be expressed as: SCing Association<A,B>＝SCing A&&SCing B; where "&&" represents a logical and operation. As another example, if the first node and the second node are in the same security domain, the link-associated security capability of the link between the first node and the second node can be expressed as: SCing Association<A,B>＝SCing A||SCing B; where "||" represents a logical or operation.

In some optional embodiments, when the first node is connected to a control node, the method may further include: the first node sends sixth information and/or seventh information to the control node, the sixth information indicating the security capability of the first node and/or the link-associated security capability of the link between the first node and the second node; the seventh information indicating the second node The sixth information and/or the seventh information are used by the control node to determine path information.

In this embodiment, if the first node is a node directly connected to a control node (such as a controller), the first node may report the node's security capabilities and/or link-associated security capabilities to the control node. Specifically, the above information may be reported to the controller through the BGP-LS protocol so that the control node may generate path information based on the policy and the corresponding node's security capabilities and/or link-associated security capabilities.

Based on the above embodiments, the present disclosure also provides an information transmission method. FIG5 is a flow chart of the information transmission method of the present disclosure embodiment; as shown in FIG5 , the method includes:

Step 201: A second node receives a first NLRI sent by a first node, where the first NLRI includes at least first information and/or second information, where the first information indicates a security capability of the first node, and the second information indicates a link-associated security capability of a link between the first node and the second node.

In some optional embodiments, the first NLRI includes a remote node descriptor field, The remote node descriptor field includes a first attribute, where the first attribute is used to represent the security capability of the first node. The remote node descriptor field includes at least the first information.

In this embodiment, the security capability of the node can be represented by the first attribute in the Remote Node Descriptors field in the NLRI. For details, please refer to Table 6 in the above embodiment.

In this embodiment, the security capability of the node can be represented by the second attribute in the Local Node Descriptors field in the NLRI. For details, please refer to Table 7 in the above embodiment.

In this embodiment, the link-associated security capability (in this embodiment, the link-associated security capability of the link between the first node and the second node) can be identified by the third attribute in the Link Descriptors field in the NLRI. For details, please refer to Table 8 in the above embodiment.

In some optional embodiments of the present disclosure, the method further includes: the second node determining a link-associated security capability of a link between the second node and the first node based at least on the security capability of the second node and the security capability of the first node.

In this embodiment, the second node may determine the link-associated security capability of the link between the second node and the first node based on the security capability of the first node and the security capability of the second node.

In some optional embodiments, the second node is based at least on the security capability of the second node. The link-associated security capability of the link between the second node and the first node is determined based on the security capability of the first node and the security capability of the first node, including: when the first node and the second node are two nodes in different security domains, the second node performs a logical AND operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node; or, when the first node and the second node are two nodes in the same security domain, the second node performs a logical OR operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node.

In some optional embodiments of the present disclosure, when the second node is connected to the control node, the method further includes: the second node sends the fourth information and/or the fifth information to the control node, the fourth information indicating the security capability of the first node and/or the link-associated security capability of the link between the first node and the second node; the fifth information indicating the security capability of the second node and/or the link-associated security capability of the link between the second node and the first node. Associated with the security capability, the fourth information and/or the fifth information is used by the control node to determine the path information.

In this embodiment, if the second node is a node directly connected to the control node (such as a controller), the second node can report the node's security capabilities and/or link-associated security capabilities to the control node. Specifically, the above information can be reported to the controller through the BGP-LS protocol so that the control node can generate path information based on the policy and the corresponding node's security capabilities and/or link-associated security capabilities.

In other embodiments, the control node receives the security capabilities of each node in the link and/or the link-associated security capabilities; when the link passes through more than two nodes, a logical AND operation or a logical OR operation can be performed based on the relevant processing logic of whether each node in the link is in the same security domain to obtain the link-associated security capabilities of the complete link.

In some optional embodiments, the method further includes: the second node sending a second NLRI to the first node, the second NLRI includes at least third information, and the third information indicates the security capability of the second node.

In this embodiment, the second node may also send third information indicating the security capability of the second node to the first node connected thereto. The manner in which the third information is carried in the second NLRI may refer to the specific description of the manner in which the first information is carried in the first NLRI, which will not be described in detail here. In other embodiments, the second NLRI may also include information indicating the link-associated security capability of the link between the second node and the first node, and the specific implementation manner may refer to the specific description of the manner in which the second information is carried in the first NLRI, which will not be described in detail here.

Figure 6 is a schematic diagram of the path sending process in the information transmission method of an embodiment of the present disclosure; as shown in Figure 6, after the control node generates path information according to the policy and the security capabilities of the corresponding nodes and/or the link-associated security capabilities, the path information is sent down to the entry node in the link. After the entry node receives the path information, it will encapsulate the received message into SRv6 message, and the forwarding node completes the forwarding according to the destination address of the next hop.

Based on the above embodiments, the present disclosure also provides an information transmission device. FIG7 is a schematic diagram of the structure of the information transmission device according to an embodiment of the present disclosure; as shown in FIG7 , the device includes: a first communication unit 31, configured to send a first NLRI to a second node, wherein the first NLRI includes at least first information and/or second information, the first information indicates the security capability of the first node, and the second information indicates the link-associated security capability of the link between the first node and the second node.

In some optional embodiments of the present disclosure, the first NLRI is Link NLRI or Type 2 NLRI (NLRI Type=2).

In some optional embodiments of the present disclosure, the first communication unit 31 is further configured to receive a second NLRI sent by the second node, where the second NLRI includes at least third information, and the third information indicates the security capability of the second node.

In some optional embodiments of the present disclosure, the apparatus further includes a first processing unit 32 configured to determine the second information based at least on the security capability of the first node and the security capability of the second node.

In some optional embodiments of the present disclosure, the first processing unit 32 is configured to, when the first node and the second node are in different security domains, process the security of the first node. Perform a logical AND operation on the full capabilities and the security capabilities of the second node to obtain the link-associated security capabilities of the link between the first node and the second node; or, when the first node and the second node are in the same security domain, perform a logical OR operation on the security capabilities of the first node and the security capabilities of the second node to obtain the link-associated security capabilities of the link between the first node and the second node.

In the disclosed embodiment, the first processing unit 32 in the device can be implemented by a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA) in actual applications; the first communication unit 31 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

The embodiment of the present disclosure also provides an information transmission device, which is applied to a second node. FIG8 is a second schematic diagram of the composition structure of the information transmission device of the embodiment of the present disclosure; as shown in FIG8 , the device includes: a second communication unit 41, configured to receive a first NLRI sent by a first node, wherein the first NLRI includes at least first information and/or second information, the first information indicates the security capability of the first node, and the second information indicates the link-associated security capability of the link between the first node and the second node.

In some optional embodiments of the present disclosure, the device also includes a second processing unit 42 configured to determine a link-associated security capability of a link between the second node and the first node based at least on the security capability of the second node and the security capability of the first node.

In some optional embodiments of the present disclosure, when the second node is connected to a control node, the second communication unit 41 is further configured to send the fourth information and/or the fifth information to the control node, the fourth information indicating the security capability of the first node and/or the link-associated security capability of the link between the first node and the second node; the fifth information indicating the security capability of the second node and/or the link-associated security capability of the link between the second node and the first node, and the fourth information and/or the fifth information are used by the control node to determine path information.

In some optional embodiments of the present disclosure, the second processing unit 42 is configured to, when the first node and the second node are two nodes in different security domains, perform a logical AND operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node; or, when the first node and the second node are two nodes in the same security domain, perform a logical OR operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node.

In some optional embodiments of the present disclosure, the second communication unit 41 is further configured to send a second NLRI to the first node, where the second NLRI includes at least third information, and the third information indicates the security capability of the second node.

In the embodiment of the present disclosure, the second processing unit 42 in the device can be composed of It can be implemented by CPU, DSP, MCU or FPGA; the second communication unit 41 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual application.

It should be noted that: the information transmission device provided in the above embodiment only uses the division of the above program modules as an example when performing information transmission. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information transmission device provided in the above embodiment and the information transmission method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

The embodiment of the present disclosure also provides a node, which is the first node or the second node in the above-mentioned embodiment. FIG9 is a schematic diagram of the hardware composition structure of the node in the embodiment of the present disclosure. As shown in FIG9, the node includes a memory 52, a processor 51, and a computer program stored in the memory 52 and executable on the processor 51. When the processor 51 executes the program, the steps of the information transmission method applied in the first node or the second node in the embodiment of the present disclosure are implemented.

Optionally, the node further includes at least one network interface 53. The various components in the node are coupled together via a bus system 54. It is understood that the bus system 54 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 54 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 54 in FIG. 9.

It can be understood that the memory 52 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (RAM), or a 32-bit ... Volatile memory may be a Ferromagnetic Random Access Memory (FRAM), a Flash Memory, a magnetic surface memory, an optical disk, or a Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory may be a magnetic disk memory or a magnetic tape memory. Volatile memory may be a Random Access Memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory 52 described in the embodiments of the present disclosure is intended to include, but is not limited to, these and any other suitable types of memory.

The method disclosed in the above-mentioned embodiment of the present disclosure can be applied to the processor 51, or implemented by the processor 51. The processor 51 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above-mentioned method can be completed by the hardware integrated logic circuit in the processor 51 or the instruction in the form of software. The above-mentioned processor 51 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 51 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present disclosure. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present disclosure can be directly embodied as a hardware decoding processor for execution, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in In the storage medium, the storage medium is located in the memory 52, and the processor 51 reads the information in the memory 52 and completes the steps of the above method in combination with its hardware.

In an exemplary embodiment, the node can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general-purpose processor, controller, MCU, microprocessor, or other electronic components to execute the aforementioned method.

In an exemplary embodiment, the disclosed embodiment further provides a computer-readable storage medium, such as a memory 52 including a computer program, which can be executed by a processor 51 of a node to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; or it can be various devices including one or any combination of the above memories.

The embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the information transmission method applied to the first node or the second node in the embodiment of the present disclosure are implemented.

The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only exemplary. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system. Or some features may be omitted or not performed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

In addition, all functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may be separately configured as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

Alternatively, if the above-mentioned integrated unit of the present disclosure is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present disclosure can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited to Without limiting this, any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in this disclosure, which should be included in the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be based on the protection scope of the claims.

Claims

An information transmission method, the method comprising:

The first node sends first network layer reachability information NLRI to the second node, where the first NLRI includes at least first information and/or second information, where the first information indicates the security capability of the first node, and the second information indicates the link-associated security capability of the link between the first node and the second node.
The method according to claim 1, wherein the first NLRI is a link NLRI or a type 2 NLRI.
The method according to claim 1, wherein the first NLRI includes a remote node descriptor field, the remote node descriptor field includes a first attribute, the first attribute is used to represent the security capability of the first node, and the remote node descriptor field includes at least the first information.
The method according to claim 1, wherein the first NLRI includes a local node descriptor field, the local node descriptor field includes a second attribute, the second attribute is used to represent the security capability of the first node, and the local node descriptor field includes at least the first information.
The method according to claim 1, wherein the first NLRI includes a link descriptor field, the link descriptor field includes a third attribute, the third attribute is used to indicate the link-associated security capability of the link between the first node and the second node, and the link descriptor field includes at least the second information.
The method according to claim 1, wherein the method further comprises:

The first node receives a second NLRI sent by the second node, where the second NLRI includes at least third information, and the third information indicates a security capability of the second node.
The method according to claim 6, wherein the method further comprises:

The first node is based at least on the security capability of the first node and the security capability of the second node. The second information is determined by all capabilities.
The method according to claim 7, wherein the first node determines the second information based at least on the security capability of the first node and the security capability of the second node, comprising:

In the case where the first node and the second node are in different security domains, the first node performs a logical AND operation on the security capability of the first node and the security capability of the second node to obtain the link-associated security capability of the link between the first node and the second node; or

When the first node and the second node are in the same security domain, the first node performs a logical OR operation on the security capability of the first node and the security capability of the second node to obtain the link-associated security capability of the link between the first node and the second node.
An information transmission method, the method comprising:

The second node receives a first NLRI sent by the first node, where the first NLRI includes at least first information and/or second information, where the first information indicates a security capability of the first node, and the second information indicates a link-associated security capability of a link between the first node and the second node.
The method according to claim 9, wherein the first NLRI is a link NLRI or a type 2 NLRI.
The method according to claim 9, wherein the first NLRI includes a remote node descriptor field, the remote node descriptor field includes a first attribute, the first attribute is used to represent the security capability of the first node, and the remote node descriptor field includes at least the first information.
The method according to claim 9, wherein the first NLRI includes a local node descriptor field, the local node descriptor field includes a second attribute, the second attribute is used to represent the security capability of the first node, and the local node descriptor field includes at least the first information.
The method according to claim 9, wherein the first NLRI includes a link descriptor field, the link descriptor field includes a third attribute, the third attribute is used to represent the link-associated security capability of the link between the first node and the second node, and the link descriptor field includes at least the second information.
The method according to claim 9, wherein the method further comprises:

The second node determines a link-associated security capability of a link between the second node and the first node based at least on the security capability of the second node and the security capability of the first node.
The method according to claim 9, wherein, when the second node is connected to the control node, the method further comprises:

The second node sends the fourth information and/or the fifth information to the control node, the fourth information represents the security capability of the first node and/or the link-associated security capability of the link between the first node and the second node; the fifth information represents the security capability of the second node and/or the link-associated security capability of the link between the second node and the first node, and the fourth information and/or the fifth information are used by the control node to determine the path information.
The method according to claim 14, wherein the second node determines the link-associated security capability of the link between the second node and the first node based at least on the security capability of the second node and the security capability of the first node, comprising:

When the first node and the second node are two nodes in different security domains, the second node performs a logical AND operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node; or

When the first node and the second node are two nodes in the same security domain, the second node performs a logical OR operation on the security capability of the second node and the security capability of the first node to obtain the link-associated security capability of the link between the second node and the first node.
The method according to claim 9, wherein the method further comprises:

The second node sends a second NLRI to the first node, where the second NLRI includes at least third information, and the third information indicates the security capability of the second node.
An information transmission device is applied to a first node, and the device includes: a first communication unit, configured to send a first NLRI to a second node, wherein the first NLRI includes at least first information and/or second information, the first information represents the security capability of the first node, and the second information represents the link-associated security capability of the link between the first node and the second node.
An information transmission device is applied to a second node, and the device includes: a second communication unit, configured to receive a first NLRI sent by a first node, wherein the first NLRI includes at least first information and/or second information, the first information represents the security capability of the first node, and the second information represents the link-associated security capability of the link between the first node and the second node.
A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8; or

When the program is executed by a processor, the steps of the method according to any one of claims 9 to 17 are implemented.
A node, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 8 when executing the program; or

When the processor executes the program, the steps of the method according to any one of claims 9 to 17 are implemented.