Message transmission method and apparatus, message verification method and apparatus

Abstract

A message transmission method and apparatus, and a message verification method and apparatus are disclosed. The method includes: acquiring protection information, the protection information being used to verify the security of a message; obtaining a Virtual Extensible Local Area Network (VXLAN) message based on the protection information, the VXLAN message including a VXLAN encapsulation and a Media Control Access (MAC) message, the protection information being located in at least one of the VXLAN encapsulation and the MAC message; and sending the VXLAN message. By simplifying the design, security protection capabilities that would otherwise require IPsec tunneling are placed within the VXLAN encapsulation and / or MAC message of the VXLAN message, thereby simplifying the IPsec message header, avoiding the increase in VXLAN message length due to the IPsec message header, reducing VXLAN message transmission resource overhead, and improving the transmission efficiency of information carried in the VXLAN message.

Description

TECHNICAL FIELD

[0001] The present application relates to the network technical field, and in particular to a message transmission method and device, and a message verification method and device. BACKGROUND

[0002] Virtual extensible local area network (VXLAN) is a protocol for constructing an overlay network in a cloud and Internet data center (IDC) environment, and VXLAN can also be extended to an open network, but security problems are also brought about.

[0003] In the related art, an Internet protocol security (IPSec) message header (also referred to as VXLAN over IPSec) is added to a VXLAN message, and the VXLAN message is encapsulated in an IPSec tunnel for transmission. The IPSec message header carries protection information, and message verification is performed through the protection information in the IPSec message header to solve the security problem.

[0004] However, adding the IPSec message header increases the message length, increases the transmission resource overhead, and reduces the transmission efficiency of the information carried in the VXLAN message. SUMMARY

[0005] The present application provides a message transmission method and device, and a message verification method and device, which can reduce the VXLAN message transmission resource overhead and improve the information transmission efficiency.

[0006] In a first aspect, the present application provides a message transmission method. The method comprises: obtaining protection information, the protection information being used to verify the security of a message; obtaining a virtual extensible local area network (VXLAN) message based on the protection information, the VXLAN message comprising VXLAN encapsulation and a media access control (MAC) message, and the protection information being located in at least one of the VXLAN encapsulation and the MAC message; and transmitting the VXLAN message.

[0007] In this implementation, the security protection capability that originally needs to be enhanced by an IPsec tunnel is placed in the VXLAN encapsulation and / or the MAC message of the VXLAN message through a simplified design, thereby simplifying the IPsec message header and avoiding the increase in the VXLAN message length caused by the IPsec message header, reducing the VXLAN message transmission resource overhead, and improving the transmission efficiency of the information carried in the VXLAN message.

[0008] In the implementation of the present application, the protection information includes at least one of the following information: a hash value of the address information, a timestamp, a random number, and a device identifier.

[0009] In the protection information, the timestamp and the random number are carried, which can prevent replay attacks.

[0010] In the protection information, the device identifier is carried, which can prevent terminal identity spoofing.

[0011] The address information includes a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC message source address, and a MAC message destination address. The hash value of the address information is calculated, which can prevent internal address spoofing, external address spoofing, and man-in-the-middle attacks.

[0012] Exemplarily, the protection information includes the hash value of the address information, the timestamp, the random number, and the device identifier. All the information is carried in the protection information, which can simultaneously prevent replay attacks, terminal identity spoofing, internal address spoofing, external address spoofing, and man-in-the-middle attacks.

[0013] In other examples, the protection information can include only one, two, or three of the above information.

[0014] In the implementation of the present application, the above method is implemented by a VXLAN tunnel endpoint device, for example, an access switch of a VXLAN tunnel.

[0015] After receiving the MAC message of the terminal, the VXLAN tunnel endpoint device performs VXLAN encapsulation on the MAC message to obtain a VXLAN message, and writes the above protection information into the VXLAN message during encapsulation.

[0016] In the implementation of the present application, the VXLAN encapsulation includes an external MAC message header, an external Internet protocol (IP) message header, an external user datagram protocol (UDP) message header, and a VXLAN message header. The MAC message includes an internal MAC message header, an internal IP message header, and a payload. The MAC message header is also an Ethernet message header.

[0017] The VXLAN tunnel source address, the VXLAN tunnel destination address, the MAC message source address, and the MAC message destination address refer to a source IP address and a destination IP address.

[0018] The VXLAN packet based on VXLAN encapsulation is usually applied in a cross-region service interconnection scenario, that is, a three-layer virtual private network (VPN) is constructed, rather than a two-layer VPN. Therefore, some two-layer protocol fields can be redefined to carry the protection information of the application.

[0019] In some possible implementation manners of the application, the protection information is located in the internal MAC packet header.

[0020] The internal MAC packet header includes a 2-byte protocol type field and a 12-byte address field, the 2-byte protocol type field cannot be used to carry the protection information, and the 12-byte address field can be used to carry the protection information.

[0021] For example, the 12 bytes of the address field are used to fill the protection information. The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0022] In this implementation manner, the 12-byte address field in the internal MAC packet header is used to carry the protection information, and the effect of carrying the protection information in the field in the VXLAN packet is achieved.

[0023] In some other possible implementation manners of the application, part of the protection information is located in the internal MAC packet header, and another part of the protection information is located in the reserved field of the VXLAN packet header of the VXLAN encapsulation.

[0024] For example, the 12 bytes of the address field are used to fill part of the protection information, and the 4 bytes of the reserved field are used to fill another part of the protection information.

[0025] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0026] In this implementation manner, the 12-byte address field in the internal MAC packet header and the 4-byte reserved field in the VXLAN packet header are used to carry the protection information, and the effect of carrying the protection information in the field in the VXLAN packet is achieved.

[0027] In some scenarios, the reserved field in the VXLAN packet header is redefined for other purposes, such as being redefined as a tenant type identifier in a cloud scenario. In this case, the reserved field in the VXLAN packet header cannot be used to carry protection information, and the protection information can only be carried in the address field in the internal MAC packet header. In other scenarios, the reserved field in the VXLAN packet header is not redefined, and in this case, the protection information can be carried in the address field in the internal MAC packet header and the reserved field in the VXLAN packet header. In this scenario, the protection information can also be carried in the reserved field in the VXLAN packet header alone, but in this case, the length of the protection information is shorter, and the information that can be carried is less.

[0028] In some examples, the protection information is encrypted data, that is, ciphertext data; for example, the protection information is encrypted and then written into the VXLAN packet. In other examples, the protection information can also be plaintext data.

[0029] In some examples, a block cipher algorithm can be used to encrypt the protection information. In other examples, other encryption algorithms can also be used to encrypt the protection information.

[0030] For example, for the aforementioned 12-byte protection information, a 4-byte block cipher algorithm can be used to encrypt the hash value of the address information, the timestamp, the random number, and the device identifier to obtain the protection information.

[0031] For example, for the aforementioned 16-byte protection information, a 4-byte block cipher algorithm can be used to encrypt the hash value of the address information, the timestamp, the random number, and the device identifier to obtain the protection information. Alternatively, an 8-byte block cipher algorithm can be used to encrypt the hash value of the address information, the timestamp, the random number, and the device identifier to obtain the protection information.

[0032] In the above encryption of the protection information, it is necessary to ensure that the same key is used at the encryption end and the decryption end. In the implementation mode of the present application, the key can be uniformly distributed by the network control center.

[0033] For example, the method further includes:

[0034] The key is received from the network control center, and the key is used for encryption.

[0035] By using the key distributed by the network control center, the consistency of the encryption and decryption keys is ensured, and the protection information of the ciphertext can be verified at the receiving end.

[0036] In the implementation mode of the present application, the network control center is responsible for time synchronization in addition to distributing the key.

[0037] For example, the method further includes:

[0038] The synchronization information includes a timestamp and a random number.

[0039] The timestamp allocated by the network control center is used to ensure consistency of the timestamp used by the sending end and the receiving end, and to ensure that the protection information can be verified at the receiving end.

[0040] In a second aspect, the present application provides a message verification method. The method comprises: receiving a virtual extensible local area network (VXLAN) message, the VXLAN message comprising a VXLAN encapsulation and a media access control (MAC) message, at least one of the VXLAN encapsulation and the MAC message comprising protection information, the protection information being used to verify the security of the message; obtaining the protection information in the VXLAN message; and verifying the VXLAN message based on the protection information.

[0041] In an implementation manner of the present application, the above method is implemented by a VXLAN tunnel endpoint device, for example, an access switch of a VXLAN tunnel.

[0042] For example, the protection information comprises at least one of the following information:

[0043] a hash value of address information, a timestamp, a random number, and a device identifier;

[0044] The address information comprises a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC message source address, and a MAC message destination address.

[0045] In a possible implementation manner, the MAC message comprises an internal MAC message header, and the protection information is located in the internal MAC message header.

[0046] For example, the internal MAC message header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill the protection information.

[0047] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0048] For example, obtaining the protection information in the VXLAN message comprises:

[0049] The encrypted protection information is obtained from the VXLAN message, and a 4-byte block cipher algorithm is used to decrypt the encrypted protection information to obtain the protection information.

[0050] In another possible implementation manner, the MAC message includes an internal MAC message header, a part of the protection information is located in the internal MAC message header, and another part of the protection information is located in a reserved field of a VXLAN message header of the VXLAN encapsulation.

[0051] For example, the internal MAC message header includes a 2-byte protocol type field and a 12-byte address field, 12 bytes of the address field are used to fill a part of the protection information, and 4 bytes of the reserved field are used to fill another part of the protection information.

[0052] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0053] For example, the protection information in the VXLAN message is obtained, and the protection information includes at least one of the following information:

[0054] The encrypted protection information is obtained from the VXLAN message, and the encrypted protection information is decrypted by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

[0055] Optionally, the method further includes:

[0056] The key is received and sent by a network control center, and the key is used for decryption.

[0057] Optionally, the method further includes:

[0058] The synchronization information is received and sent by a network control center, and the synchronization information includes a timestamp and a random number.

[0059] In a third aspect, the present application provides a message transmission device. The device includes:

[0060] An obtaining unit is configured to obtain protection information, the protection information being used to verify security of a message;

[0061] A processing unit is configured to obtain a virtual extensible local area network (VXLAN) message based on the protection information, the VXLAN message including VXLAN encapsulation and a media access control (MAC) message, and the protection information being located in at least one of the VXLAN encapsulation and the MAC message;

[0062] A sending unit is configured to send the VXLAN message.

[0063] For example, the protection information includes at least one of the following information:

[0064] A hash value of address information, a timestamp, a random number, and a device identifier;

[0065] The address information includes a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC message source address and a MAC message destination address.

[0066] In a possible implementation, the MAC message includes an internal MAC message header, and the protection information is located in the internal MAC message header.

[0067] For example, the internal MAC message header includes a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill the protection information.

[0068] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0069] For example, the obtaining unit is configured to encrypt the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm to obtain the protection information.

[0070] In another possible implementation, the MAC message includes an internal MAC message header, and part of the protection information is located in the internal MAC message header, and another part of the protection information is located in a reserved field of a VXLAN message header of the VXLAN encapsulation.

[0071] For example, the internal MAC message header includes a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill part of the protection information, and the 4 bytes of the reserved field are used to fill another part of the protection information.

[0072] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0073] For example, the obtaining unit is configured to encrypt the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

[0074] Optionally, the apparatus further includes:

[0075] The receiving unit is configured to receive a key sent by the network control center, and the key is used for encryption.

[0076] Optionally, the apparatus further includes:

[0077] The receiving unit is configured to receive synchronization information sent by the network control center, and the synchronization information includes a timestamp and a random number.

[0078] In a fourth aspect, the present application provides a message verification apparatus. The apparatus includes:

[0079] The receiving unit is configured to receive a VXLAN (Virtual Extensible Local Area Network) packet, wherein the VXLAN packet comprises a VXLAN encapsulation and a MAC (Media Control Access) packet, at least one of the VXLAN encapsulation and the MAC packet comprises protection information, and the protection information is used to verify the security of the packet.

[0080] The obtaining unit is configured to obtain the protection information in the VXLAN packet.

[0081] The processing unit is configured to verify the VXLAN packet based on the protection information.

[0082] For example, the protection information comprises at least one of the following information:

[0083] a hash value of address information, a timestamp, a random number and a device identifier.

[0084] The address information comprises a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC packet source address and a MAC packet destination address.

[0085] In a possible implementation, the MAC packet comprises an internal MAC packet header, and the protection information is located in the internal MAC packet header.

[0086] For example, the internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill the protection information.

[0087] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0088] For example, the obtaining unit is configured to obtain encrypted protection information from the VXLAN packet, and decrypt the encrypted protection information by using a 4-byte block cipher algorithm to obtain the protection information.

[0089] In another possible implementation, the MAC packet comprises an internal MAC packet header, and part of the protection information is located in the internal MAC packet header, and another part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation.

[0090] For example, the internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill part of the protection information, and 4 bytes of the reserved field are used to fill another part of the protection information.

[0091] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0092] The obtaining unit is configured to obtain the encrypted protection information from the VXLAN packet, and decrypt the encrypted protection information by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

[0093] Optionally, the receiving unit is further configured to receive a key sent by the network control center, and the key is used for decryption.

[0094] Optionally, the receiving unit is further configured to receive synchronization information sent by the network control center, and the synchronization information includes a timestamp and a random number.

[0095] In a fifth aspect, a network device is provided. The network device includes a processor and a memory. The memory is configured to store software programs and modules. The processor is configured to implement the method in the first aspect or any possible implementation of the first aspect, or implement the method in the second aspect or any possible implementation of the second aspect, by running or executing the software programs and / or modules stored in the memory.

[0096] Optionally, the processor is one or more, and the memory is one or more.

[0097] Optionally, the memory can be integrated with the processor, or the memory and the processor are separately arranged.

[0098] In a specific implementation process, the memory can be a non-transitory memory, for example, a read only memory (ROM), which can be integrated on the same chip with the processor, or arranged on different chips respectively. The type of the memory and the arrangement manner of the memory and the processor are not limited in the present application.

[0099] In a sixth aspect, a computer program product is provided. The computer program product includes computer program codes, which, when executed by a computer, cause the computer to perform the method in the first aspect or any possible implementation of the first aspect, or perform the method in the second aspect or any possible implementation of the second aspect.

[0100] In a seventh aspect, a computer readable storage medium is provided. The computer readable storage medium is configured to store program codes executed by a processor. The program codes include codes for implementing the method in any possible implementation of the first aspect, or implementing the method in the second aspect or any possible implementation of the second aspect.

[0101] In an eighth aspect, a chip is provided. The chip includes a processor configured to invoke and run instructions stored in a memory, so that a network device in which the chip is installed performs the method in any possible implementation of the first aspect, or performs the method in the second aspect or any possible implementation of the second aspect.

[0102] In a ninth aspect, another chip is provided. The another chip includes an input interface, an output interface, a processor and a memory. The input interface, the output interface, the processor and the memory are connected through internal connection paths. The processor is configured to execute code in the memory, and when the code is executed, the processor is configured to perform the method in any possible implementation of the first aspect, or perform the method in the second aspect or any possible implementation of the second aspect.

[0103] In a tenth aspect, a packet transmission system is provided. The system includes the apparatus in the third aspect or any possible implementation of the third aspect, and the apparatus in the fourth aspect or any possible implementation of the fourth aspect. BRIEF DESCRIPTION OF DRAWINGS

[0104] Figure 1 FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

[0105] Figure 2 FIG. 2 is a flowchart of a packet transmission method provided by an embodiment of the present application;

[0106] Figure 3 FIG. 3 is a flowchart of a packet verification method provided by an embodiment of the present application;

[0107] Figure 4 FIG. 4 is a flowchart of a packet transmission method provided by an embodiment of the present application;

[0108] Figure 5 FIG. 5 is a schematic diagram of a protection information processing process provided by an embodiment of the present application;

[0109] Figure 6 FIG. 6 is a schematic diagram of a protection information processing process provided by an embodiment of the present application;

[0110] Figure 7 FIG. 7 is a block diagram of a packet transmission apparatus provided by an embodiment of the present application;

[0111] Figure 8 FIG. 8 is a block diagram of a packet verification apparatus provided by an embodiment of the present application;

[0112] Figure 9 FIG. 9 is a structural schematic diagram of a network device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0113] For the purpose, technical solutions and advantages of the present application to be clearer, the embodiments of the present application will be described in further detail below with reference to the drawings.

[0114] In order to facilitate the understanding of the technical solutions provided by the embodiments of the present application, first, the system structure of the present application will be introduced.

[0115] Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present application. Referring to Figure 1 , the system architecture includes an organization 10 and a network 20.

[0116] Exemplarily, the organization 10 can be a virtual machine, a server, a virtualized server, other devices or virtualized devices, and the organization 10 can also be a virtual local area network (VLAN) or other networks.

[0117] Exemplarily, the network 20 can be an IP network, and the network 20 is an underlay network in the system architecture. The network 20 includes a service access component 21 and a network control component 22. The VXLAN tunnel is established between the service access components 21, and the service access components 21 are connected with the organization 10 and the network control component 22.

[0118] In some possible implementation manners, the service access component 21 can be a VXLAN tunnel endpoint (VXLAN tunnel endpoint, VTEP) device, that is, an access switch of the VXLAN tunnel, and the access switch can be a top of rack (TOR) switch. The VTEP device is an edge device of the VXLAN network, and is the starting point and the ending point of the VXLAN tunnel. For example, the original data frame sent by a source device is encapsulated into a VXLAN format packet on the VTEP, and is delivered to another VTEP in the IP network, and the original data frame is restored by decapsulation and conversion, and is finally forwarded to a destination device. In this implementation manner, the VTEP device performs functions such as encryption and decryption of protection information, writing of the protection information into the VXLAN packet, VXLAN packet integrity check, and VXLAN packet security verification based on the protection information in addition to the above functions.

[0119] In other possible implementation manners, the service access component 21 can be a newly added network device, which is connected with and interacts with the VTEP device to implement functions such as encryption and decryption of protection information, writing of the protection information into the VXLAN packet, VXLAN packet integrity check, and VXLAN packet security verification based on the protection information.

[0120] The network control component 22 can be a network control center, i.e., a network controller, which is a full network management and control center deployed in the cloud. The network control component is a control medium between the service management system and the network infrastructure (VTEP device), and realizes unified management and control of the entire overlay network. In the implementation of the present application, the network control component 22 is also responsible for periodically synchronizing the time stamp and key of the service access component 21 distributed in various places.

[0121] Exemplarily, the network 20 can adopt a three-layer network architecture, or a leaf spine network architecture, which is not limited in the present application.

[0122] The system architecture provided by the embodiments of the present application can be an overlay network constructed by the VXLAN protocol in an untrusted environment, for example, a cross-regional network constructed on the Internet or a cloud backbone network. The embodiments of the present application solve the security risks faced by VXLAN in an open network without increasing the length of additional messages and affecting the normal interaction of the protocol.

[0123] Figure 2 is a flowchart of a message transmission method provided by an embodiment of the present application. The method can be executed by the service access component 21 shown in Figure 1 As shown in Figure 2 The method includes the following steps.

[0124] S101: Obtain protection information.

[0125] The protection information is used to verify the security of the message.

[0126] S102: Obtain a virtual extensible local area network VXLAN message based on the protection information.

[0127] The VXLAN message includes VXLAN encapsulation and a media access control MAC message, and the protection information is located in at least one of the VXLAN encapsulation and the MAC message.

[0128] S103: Send the VXLAN message.

[0129] The method provided by the embodiments of the present application simplifies the IPsec message header by placing the security protection capability originally required to be enhanced by the Ipsec tunnel into the VXLAN encapsulation and / or MAC message of the VXLAN message, thereby avoiding the increase of the VXLAN message length caused by the IPsec message header, reducing the transmission resource overhead of the VXLAN message, and improving the transmission efficiency of the information carried in the VXLAN message.

[0130] Figure 3is a flow chart of a packet verification method provided by an embodiment of the present application. The method can be executed by Figure 1 As shown in Figure 3 The method comprises the following steps.

[0131] S201: receiving a virtual extensible local area network (VXLAN) packet.

[0132] The VXLAN packet comprises a VXLAN encapsulation and a media access control (MAC) packet, and at least one of the VXLAN encapsulation and the MAC packet comprises protection information, which is used to verify the security of the packet.

[0133] S202: obtaining the protection information in the VXLAN packet.

[0134] S203: verifying the VXLAN packet based on the protection information.

[0135] The method provided by the embodiment of the present application simplifies the IPsec packet header by carrying the protection information in the VXLAN encapsulation and / or the MAC packet of the VXLAN packet, avoids the increase of the length of the VXLAN packet caused by the IPsec packet header, reduces the transmission resource overhead of the VXLAN packet, and improves the transmission efficiency of the information carried in the VXLAN packet.

[0136] Figure 4 is a flow chart of a packet transmission method provided by an embodiment of the present application. The method can be executed by Figure 1 As shown in Figure 4 The method comprises the following steps.

[0137] S300: the first VTEP device receives a MAC packet.

[0138] For example, the first VTEP device receives a MAC packet sent by a virtual machine connected thereto.

[0139] S301: the network control center sends a key and synchronization information. The first VTEP device and the second VTEP device receive the key and the synchronization information.

[0140] The synchronization information comprises a timestamp and a random number.

[0141] In one implementation manner, the key and the synchronization information are transmitted simultaneously. In another implementation manner, the key and the synchronization information are transmitted separately.

[0142] The step S301 is periodically executed, and the step S301 and the step S300 have no sequence, that is, the step S300 can be executed first and then the step S301, or the step S301 can be executed first and then the step S300.

[0143] S302: The first VTEP device obtains the protection information based on the MAC message and the synchronization information.

[0144] In the implementation manner of the present application, the protection information comprises at least one of the following information: a hash value of address information, a timestamp, a random number and a device identifier.

[0145] The timestamp and the random number are carried in the protection information, which can prevent replay attacks.

[0146] The device identifier is carried in the protection information, which can prevent terminal identity spoofing.

[0147] The address information comprises a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC message source address and a MAC message destination address. The hash value of the address information can prevent internal address spoofing, external address spoofing and man-in-the-middle attacks.

[0148] The VXLAN tunnel source address, the VXLAN tunnel destination address, the MAC message source address and the MAC message destination address refer to source IP addresses and destination IP addresses.

[0149] Exemplarily, the protection information comprises the hash value of the address information, the timestamp, the random number and the device identifier. All the information is carried in the protection information, which can prevent replay attacks, terminal identity spoofing, internal address spoofing, external address spoofing and man-in-the-middle attacks.

[0150] In other examples, the protection information can comprise only one, two or three of the above information.

[0151] In the implementation manner of the present application, the first VTEP device obtains the timestamp and the random number based on the synchronization information; the first VTEP device obtains a device sequence code or other terminal identifier as the device identifier based on the MAC message, or the first VTEP device obtains a local software certificate identifier or other local hardware identifier as the device identifier; the first VTEP device obtains the MAC message source address and the MAC message destination address based on the MAC message, and obtains the VXLAN tunnel source address and the VXLAN tunnel destination address based on the VXLAN tunnel, and performs hash algorithm operation on the VXLAN tunnel source address, the VXLAN tunnel destination address, the MAC message source address and the MAC message destination address to obtain the address information.

[0152] S303: The first VTEP device encrypts the protection information based on the key.

[0153] In one example, the hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0154] The code of the 12-byte protection information is defined as follows:

[0155] struct{

[0156] uint32 address hashcode;

[0157] uint16 timestamp;

[0158] uint8 random;

[0159] char device id[5];

[0160] }

[0161] address hashcode:=hash(

[0162] outer.srcip,outer.dstip,

[0163] inner.srcip,inner.dstip )

[0165] In another example, the hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0166] The code of the 16-byte protection information is defined as follows:

[0167] struct{

[0168] uint32 address hashcode;

[0169] uint16 timestamp;

[0170] uint16 random;

[0171] char device id[8];

[0172] }

[0173] address hashcode:=hash(

[0174] outer.srcip, outer.dstip,

[0175] inner.srcip, inner.dstip )

[0177] In some examples, the protection information can be encrypted by using a block cipher algorithm. The block cipher algorithm divides the plaintext into blocks of equal length, and encrypts or decrypts each block by using a certain algorithm and a symmetric key. The block cipher algorithm can use algorithms such as the advanced encryption standard (AES) and the triple data encryption standard (3DES).

[0178] In other examples, other encryption algorithms can also be used to encrypt the protection information.

[0179] For example, for the aforementioned 12-byte protection information, the hash value of the address information, the timestamp, the random number and the device identifier can be encrypted by using a 4-byte block cipher algorithm to obtain the protection information.

[0180] For example, for the aforementioned 16-byte protection information, the hash value of the address information, the timestamp, the random number and the device identifier can be encrypted by using a 4-byte block cipher algorithm to obtain the protection information. Alternatively, the hash value of the address information, the timestamp, the random number and the device identifier can be encrypted by using an 8-byte block cipher algorithm to obtain the protection information.

[0181] S304: The first VTEP device obtains a VXLAN packet based on the encrypted protection information and the MAC packet.

[0182] In order to understand the VXLAN packet of the present application, the structure of the VXLAN packet is first described:

[0183] The structure of the VXLAN packet is shown in Table 1 below. The VXLAN encapsulation includes an outer MAC packet header (Outer MAC Header), an outer IP packet header (Outer IP Header), an outer UDP packet header (Outer UDP Header) and a VXLAN packet header (VXLAN Header). The MAC packet includes an inner MAC packet header (Inner MAC Header), an inner IP packet header (Inner IP Header) and a payload (Payload). The MAC packet header is also an Ethernet packet header.

[0184] Table 1

[0185]

[0186] Table 2 shows the external MAC packet header, including the destination MAC address (MAC DA), the source MAC address (MAC SA), the 802.1Q tag (802.1Q Tag), and the Ethernet type (Ethernet Type).

[0187] Table 2

[0188] MAC DA MAC SA 802.1Q Tag Ethernet Type

[0189] Wherein, the MAC DA is the MAC address corresponding to the next hop IP address in the routing table, which is found by the first VTEP device according to the destination VTEP address. The MAC SA is the MAC address of the first VTEP device. The 802.1Q Tag is an optional field, which is the VLAN Tag carried in the packet.

[0190] Table 3 shows the external IP packet header, including at least the protocol (Protocol), the source IP address (IP SA), and the destination IP address (IP DA).

[0191] Table 3

[0192] …… Protocol …… IP SA IP DA

[0193] Wherein, the source IP address is the IP address of the local VTEP (the first VTEP device) of the VXLAN tunnel. The destination IP address is the IP address of the remote VTEP (the second VTEP device) of the VXLAN tunnel. If the Underlay network is an IPv4 network, the above-mentioned IP address is of the IPv4 type; if the Underlay network is an IPv6 network, the above-mentioned IP address is of the IPv6 type.

[0194] Table 4 shows the external UDP packet header, including the source port number (Source Port), the destination port number (DestPort), the UDP length (UDP Length), and the UDP checksum (UDP Checksum).

[0195] Table 4

[0196] Source Port Dest Port UDP Length UDP Checksum

[0197] Wherein, the source port number is the value calculated by the inner packet through the hash algorithm. The destination port number is 4789.

[0198] Table 5 shows the VXLAN packet header, including the VXLAN identification (VXLAN flags), the reserved (Reserved), and the VXLAN network identification (VNI).

[0199] Table 5

[0200] VXLAN flags Reserved VNI Reserved

[0201] The VXLAN identifier is 8 bits long and has a value of 00001000. The VXLAN network identifier is 24 bits long and is used to distinguish VXLAN segments. The VXLAN header includes two reserved fields, with lengths of 24 bits and 8 bits respectively, which is 4 bytes in length, and the default value is 0.

[0202] Table 6 shows the internal MAC header, including the destination MAC address (Dest MAC), source MAC address (Src MAC), and protocol type (Type).

[0203] Table 6

[0204] Dest MAC Src MAC Type

[0205] The destination MAC address and the source MAC address are both 6 bytes long, for a total of 12 bytes. The protocol type is 2 bytes long.

[0206] VXLAN-encapsulated VXLAN packets are typically used in scenarios involving cross-regional business interconnection, i.e., building Layer 3 VPNs rather than Layer 2 VPNs. Therefore, this application can redefine some of the Layer 2 protocol fields to carry the protection information of this application.

[0207] In some possible implementations of this application, all protection information is located in the internal MAC header.

[0208] The internal MAC header includes a 2-byte protocol type field and a 12-byte address field (including the destination MAC address and the source MAC address). The 2-byte protocol type field cannot be used to carry protection information, while the 12-byte address field can be used to carry 12 bytes of protection information.

[0209] like Figure 5 As shown, the 32-bit address information hash value, 16-bit timestamp, 8-bit random number, and 40-bit device identifier are encrypted using a block cipher algorithm to obtain 96 bits of encrypted protection information, which is then filled into the 48-bit destination MAC address (MAC DA) and 48-bit source MAC address (MAC SA) fields.

[0210] In this implementation, the 12-byte address field in the internal MAC header is used to carry protection information, achieving the effect of using fields within the VXLAN packet to carry protection information.

[0211] In some other possible implementations of this application, part of the protection information is located in the internal MAC header, and another part of the protection information is located in the reserved fields of the VXLAN header encapsulated by VXLAN.

[0212] For example, 12 bytes of the address field are used to fill one part of the protection information, and 4 bytes of the reserved field are used to fill another part of the protection information. That is, the address field and the reserved field together carry 16 bytes of protection information.

[0213] like Figure 6 As shown, the hash value of the 32-bit address information, the 16-bit timestamp, the 16-bit random number, and the 64-bit device identifier are encrypted using a block cipher algorithm to obtain 128 bits of encrypted protection information, which is then filled into the 32-bit reserved field, the 48-bit destination MAC address (MAC DA) field, and the 48-bit source MAC address (MAC SA) field.

[0214] In this implementation, the protection information is carried by the 12-byte address field in the internal MAC header and the 4-byte reserved field in the VXLAN header, achieving the effect of carrying protection information using fields within the VXLAN packet.

[0215] In some scenarios, reserved fields in the VXLAN header are redefined for other purposes, such as identifying different tenant types in cloud environments. In this case, reserved fields in the VXLAN header cannot be used to carry protection information; only the address field in the internal MAC header can be used. In other scenarios, reserved fields in the VXLAN header are not redefined, and both the address field in the internal MAC header and reserved fields in the VXLAN header can be used to carry protection information. In this scenario, reserved fields in the VXLAN header can also be used alone to carry protection information, but the protection information will be shorter and can carry less information.

[0216] S305: The first VTEP device sends a VXLAN message. The second VTEP device receives the VXLAN message.

[0217] S306: The second VTEP device obtains the encrypted protection information in the VXLAN message.

[0218] The second VTEP device obtains encrypted protection information from the preset fields in the VXLAN message.

[0219] In one scenario, the second VTEP device obtains 12 bytes of encrypted protection information from the address field of the internal MAC header in the VXLAN message.

[0220] In another case, the second VTEP device obtains 12 bytes of encrypted protection information from the address field of the inner MAC packet header in the VXLAN packet, and obtains 4 bytes of encrypted protection information from the reserved field of the VXLAN packet header in the VXLAN packet, to obtain a total of 16 bytes of encrypted protection information.

[0221] S307: The second VTEP device decrypts the encrypted protection information based on the key.

[0222] In one case, the encrypted protection information is 12 bytes, and the encrypted protection information is decrypted by using a 4-byte block cipher algorithm to obtain the protection information.

[0223] In another case, the encrypted protection information is 16 bytes, and the encrypted protection information is decrypted by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

[0224] S308: The second VTEP device verifies the VXLAN packet based on the protection information.

[0225] When the protection information simultaneously includes the hash value of the address information, the timestamp, the random number and the device identifier, the second VTEP device verifies the hash value, the timestamp, the random number and the device identifier respectively, and when each item is verified, it is determined that the packet verification is passed, otherwise it is determined that the packet verification is not passed.

[0226] Among them, the timestamp, the random number: compare whether the timestamp (random number) received from the network control center and the timestamp (random number) in the protection information are consistent, if consistent, then the verification is passed, otherwise the verification is not passed. By verifying the timestamp and the random number, replay attacks can be prevented.

[0227] Device identifier: verify whether the device identifier is a legal device identifier, if legal, then the verification is passed, otherwise the verification is not passed. By verifying the device identifier, terminal authentication and authorization can be realized, and terminal identity spoofing can be prevented.

[0228] Hash value of address information: obtain the VXLAN tunnel source address, the VXLAN tunnel destination address, the MAC packet source address and the MAC packet destination address in the same way as the first VTEP device, then calculate the hash value, and compare whether the calculated hash value and the hash value in the protection information are consistent, if consistent, then the verification is passed, otherwise the verification is not passed. By verifying the hash value of the address information, internal address spoofing, external address spoofing and man-in-the-middle attacks can be prevented.

[0229] Through the verification of the above content, the effects of preventing replay attacks, preventing terminal identity spoofing, preventing internal address spoofing, preventing external address spoofing, and preventing man-in-the-middle attacks can be achieved at the same time. In addition, when the above protection information is verified, it also indicates that the message integrity is verified.

[0230] S309: When the verification is passed, the second VTEP device sends the MAC message in the VXLAN message.

[0231] For example, the second VTEP device decapsulates the VXLAN message to obtain the MAC message, and then forwards the MAC message according to the internal IP message header therein.

[0232] When the verification fails, the second VTEP device discards the VXLAN message.

[0233] The VXLAN message from the first VTEP device to the second VTEP device needs to be verified for security, and correspondingly, the VXLAN message from the second VTEP device to the first VTEP device also needs to be verified for security, and the transmission and verification processes are the same.

[0234] In the embodiments of the present application, when VXLAN messages are used for service interaction, protection information is carried from the starting point of the tunnel to the ending point of the tunnel, and the VXLAN message is checked for security at the ending point of the tunnel. Only the message that passes the security check will continue to be processed for service, otherwise it will be discarded directly, so as to achieve the purpose of secure transmission.

[0235] In the embodiments of the present application, when the tunnel endpoint device is used to execute the above method, simple protocol field redefinition is performed at the tunnel endpoint, so that the purpose of realizing cross-regional secure and efficient transmission in an open or untrusted network can be achieved without modifying other network infrastructure except the tunnel endpoint. The functions of preventing replay attacks, terminal authentication and authentication, etc. are realized.

[0236] Figure 7 is a block diagram of a message transmission device provided by an embodiment of the present application. The message transmission device can be realized by software, hardware, or a combination of both to become all or part of a network device (for example, a VTEP device). The message transmission device can include an acquisition unit 401, a processing unit 402, and a sending unit 403.

[0237] The acquisition unit 401 is configured to acquire protection information, and the protection information is used to verify the security of the message.

[0238] The processing unit 402 is configured to obtain a VXLAN (Virtual Extensible Local Area Network) packet based on protection information, the VXLAN packet comprising a VXLAN encapsulation and a MAC (Media Control Access) packet, and the protection information being located in at least one of the VXLAN encapsulation and the MAC packet.

[0239] The sending unit 403 is configured to send the VXLAN packet.

[0240] For example, the protection information comprises at least one of the following information:

[0241] a hash value of address information, a timestamp, a random number and a device identifier.

[0242] The address information comprises a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC packet source address and a MAC packet destination address.

[0243] In a possible implementation, the MAC packet comprises an internal MAC packet header, and the protection information is located in the internal MAC packet header.

[0244] For example, the internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill the protection information.

[0245] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0246] For example, the obtaining unit 401 is configured to encrypt the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm to obtain the protection information.

[0247] In another possible implementation, the MAC packet comprises an internal MAC packet header, and part of the protection information is located in the internal MAC packet header, and another part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation.

[0248] For example, the internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill part of the protection information, and 4 bytes of the reserved field are used to fill another part of the protection information.

[0249] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0250] For example, the obtaining unit 401 is configured to encrypt the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

[0251] Optionally, the apparatus further comprises:

[0252] The receiving unit 404 is configured to receive a key sent by the network control center, the key being used for encryption.

[0253] Optionally, the receiving unit 404 is configured to receive synchronization information sent by the network control center, the synchronization information comprising a timestamp and a random number.

[0254] It should be noted that the message transmission apparatus provided in the above embodiments is only taken as an example for the division of the above functional units, and in actual applications, the above functions can be completed by different functional units according to needs, that is, the internal structure of the device is divided into different functional units to complete all or part of the above-described functions. In addition, the message transmission apparatus and the message transmission method provided in the above embodiments belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be described here.

[0255] Figure 8 is a block diagram of a message verification apparatus provided by an embodiment of the present application. The message verification apparatus can be realized by software, hardware or a combination of both to become all or part of a network device (for example, a VTEP device). The message verification apparatus can comprise a receiving unit 501, an obtaining unit 502 and a processing unit 503.

[0256] The receiving unit 501 is configured to receive a virtual extensible local area network (VXLAN) message, the VXLAN message comprising a VXLAN encapsulation and a media access control (MAC) message, at least one of the VXLAN encapsulation and the MAC message comprising protection information, the protection information being used for verifying the security of the message.

[0257] The obtaining unit 502 is configured to obtain the protection information in the VXLAN message.

[0258] The processing unit 503 is configured to verify the VXLAN message based on the protection information.

[0259] For example, the protection information comprises at least one of the following information:

[0260] a hash value of address information, a timestamp, a random number and a device identifier;

[0261] The address information comprises a VXLAN tunnel source address, a VXLAN tunnel destination address, a MAC message source address and a MAC message destination address.

[0262] In a possible implementation, the MAC message comprises an internal MAC message header, and the protection information is located in the internal MAC message header.

[0263] Exemplarily, the internal MAC message header includes a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill the protection information.

[0264] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

[0265] Exemplarily, the obtaining unit 502 is configured to obtain the encrypted protection information from the VXLAN message, and decrypt the encrypted protection information by using the 4-byte block cipher algorithm to obtain the protection information.

[0266] In another possible implementation, the MAC message includes an internal MAC message header, part of the protection information is located in the internal MAC message header, and another part of the protection information is located in the reserved field of the VXLAN message header of the VXLAN encapsulation.

[0267] Exemplarily, the internal MAC message header includes a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used to fill part of the protection information, and the 4 bytes of the reserved field are used to fill another part of the protection information.

[0268] The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

[0269] Exemplarily, the obtaining unit 502 is configured to obtain the encrypted protection information from the VXLAN message, and decrypt the encrypted protection information by using the 4-byte block cipher algorithm or the 8-byte block cipher algorithm to obtain the protection information.

[0270] Optionally, the receiving unit 501 is further configured to receive a key sent by the network control center, and the key is used for decryption.

[0271] Optionally, the receiving unit 501 is further configured to receive synchronization information sent by the network control center, and the synchronization information includes a timestamp and a random number.

[0272] It should be noted that the message verification device provided in the above embodiments is only exemplified by the division of the above functional units when verifying the message, and in actual application, the above functions can be completed by different functional units according to needs, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. In addition, the message verification device and the message verification method provided in the above embodiments belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0273] Figure 9A schematic diagram of the structure of the network device 150 provided in an embodiment of this application is shown. Figure 9 The network device 150 shown is used to perform the above. Figure 2 to Figure 6 The network device involved in the message transmission method or message authentication method shown in any of the diagrams can be the aforementioned VTEP device. This network device 150 can be implemented using a general bus architecture.

[0274] like Figure 9 As shown, the network device 150 includes at least one processor 151, a memory 153, and at least one communication interface 154.

[0275] Processor 151 may be, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the embodiments of this application. For example, processor 151 may include an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in connection with the embodiments of this application. A processor may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0276] Optionally, network device 150 also includes a bus. The bus is used to transmit information between the components of network device 150. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9Only one bus is shown for simplicity, but there can be more buses or more types of buses.

[0277] The memory 153 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions that are not changed often, also is, for example, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions that are changed often, also is, for example, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices or any other medium capable of storing instructions or data that is accessible to the computer, but not limited to. The memory 153 is, for example, independent and connected to the processor 151 through the bus. The memory 153 can also be integrated with the processor 151.

[0278] The communication interface 154 uses any transceiver type device to communicate with other devices or communication networks, which can be an Ethernet, a radio access network (RAN) or a wireless local area network (WLAN), etc. The communication interface 154 can include a wired communication interface and also include a wireless communication interface. Specifically, the communication interface 154 can be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. In the embodiment of the present application, the communication interface 154 can be used for the network device 150 to communicate with other devices.

[0279] In a specific implementation, as an embodiment, the processor 151 can include one or more CPUs, such as Figure 9CPU0 and CPU1 shown in FIG. 1. Each of these processors can be a single-CPU processor or a multi-CPU processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0280] In a particular implementation, as one example, network device 150 can include multiple processors, such as processor 151 and processor 155 shown in FIG. 1. Each of these processors can be a single-CPU processor or a multi-CPU processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). Figure 9 In a particular implementation, as one example, network device 150 can include multiple processors, such as processor 151 and processor 155 shown in FIG. 1. Each of these processors can be a single-CPU processor or a multi-CPU processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0281] In a particular implementation, as one example, network device 150 can include multiple processors, such as processor 151 and processor 155 shown in FIG. 1. Each of these processors can be a single-CPU processor or a multi-CPU processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0282] In some embodiments, memory 153 is used to store program code 1510 for implementing the solutions of the present application, and processor 151 can execute program code 1510 stored in memory 153. That is, network device 150 can execute program code 1510 in memory 153 through processor 151 to implement the data processing method provided by the method embodiments. Program code 1510 can include one or more software modules. Alternatively, processor 151 itself can also store program code or instructions for implementing the solutions of the present application.

[0283] In a particular implementation, network device 150 of the embodiments of the present application can correspond to the controller in each of the above method embodiments, and processor 151 in network device 150 reads instructions in memory 153 to cause network device 150 to perform all or part of the operations performed by the controller. Figure 9 The network device 150 shown in FIG. 1 can perform all or part of the operations performed by the controller.

[0284] Specifically, the processor 151 is configured to acquire protection information, the protection information being used to verify security of the packet; acquire a virtual extensible local area network (VXLAN) packet based on the protection information, the VXLAN packet comprising a VXLAN encapsulation and a media access control (MAC) packet, and the protection information being located in at least one of the VXLAN encapsulation and the MAC packet; and send the VXLAN packet.

[0285] Alternatively, the processor 151 is configured to receive a virtual extensible local area network (VXLAN) packet, the VXLAN packet comprising a VXLAN encapsulation and a media access control (MAC) packet, at least one of the VXLAN encapsulation and the MAC packet comprising protection information, the protection information being used to verify security of the packet; acquire the protection information in the VXLAN packet; and verify the VXLAN packet based on the protection information.

[0286] Other optional embodiments will not be described herein for the sake of brevity.

[0287] In the above embodiments, the protection information is located in at least one of the VXLAN encapsulation and the MAC packet. Figure 2 to Figure 6 Any of the steps of the packet transmission method or the packet verification method shown in the drawings can be completed by integrated logic circuits of hardware or instructions in the form of software in the processor of the network device 150. The steps of the method disclosed in the embodiments of the present application can be directly embodied as execution completed by a hardware processor, or executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or the like. The storage medium is located in the memory, and the processor reads information in the memory and combines the hardware to complete the steps of the above method. To avoid repetition, the above will not be described in detail.

[0288] The embodiments of the present application also provide a chip, comprising: an input interface, an output interface, a processor and a memory. The input interface, the output interface, the processor and the memory are connected through internal connection paths. The processor is configured to execute the code in the memory, and when the code is executed, the processor is configured to execute any of the packet transmission method or the packet verification method.

[0289] It should be understood that the above processor can be a CPU, and can also be other general-purpose processors, DSPs, ASICs, FPGAs or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. It should be noted that the processor can be an ARM architecture processor.

[0290] Further, in an alternative embodiment, the processor is one or more, and the memory is one or more. Optionally, the memory can be integrated with the processor, or the memory can be located apart from the processor. The memory can include read-only memory and random access memory, and can also include non-volatile memory, including for example one or more topologies of magnetic, magneto-optical and optical storage media. The memory can also store references and target blocks.

[0291] The memory can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. By way of illustration, and not limitation, non-volatile memory can be ROM, PROM, EPROM, EEPROM, or flash memory. Volatile memory can be RAM, which acts as external cache memory. By way of example, and not limitation, many forms of RAM are available, including SRAM, DRAM, SDRAM, DDR SDRAM, ESDRAM, SLDRAM, and DR RAM.

[0292] In an embodiment of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores computer instructions. When the computer instructions stored in the computer readable storage medium are executed by a network device, the network device performs the packet transmission method or the packet verification method provided above.

[0293] In an embodiment of the present application, a computer program product containing instructions is also provided, and when the computer program product is run on a network device, the network device performs the packet transmission method or the packet verification method provided above.

[0294] In the above embodiments, all or part of the steps can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the steps can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as DVD), or semiconductor media (such as solid state disk) and the like.

[0295] Those of ordinary skill in the art understand that all or part of the steps of the above embodiments can be completed by hardware, or by program instructions to instruct related hardware, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be read only memory, disk or optical disk, etc.

[0296] The above is only an optional embodiment of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application can be easily thought of by those skilled in the art, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0297] Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the usual meaning understood by those skilled in the art. The "first", "second", "third" and similar words used in the patent application and claims of the present application do not represent any order, quantity or importance, but are used to distinguish different components. Similarly, "one" or "a" and similar words do not represent a quantity limitation, but represent the existence of at least one. "Include" or "contain" and similar words mean that the elements or objects appearing before "include" or "contain" cover the elements or objects listed after "include" or "contain" and their equivalents, and do not exclude other elements or objects.

[0298] The above merely provides an example of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall into the protection scope of the present application.

Claims

1. A method of transmitting a packet, characterized by, The method is performed by service access components in a network, VXLAN tunnels are established between the service access components, the network is a cross-regional network constructed on an Internet or a cloud backbone network, and the method comprises the following steps: Obtaining protection information, the protection information is used for verifying the security of a packet, and the protection information comprises a hash value of address information, a timestamp, a random number and a device identifier; Obtaining a VXLAN packet based on the protection information, the VXLAN packet comprises a VXLAN encapsulation and a MAC packet, the MAC packet comprises an internal MAC packet header, all of the protection information is located in the internal MAC packet header, or part of the protection information is located in the internal MAC packet header, and the other part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation; Sending the VXLAN packet.

2. The method of claim 1, wherein, The internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used for filling the protection information; The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 1 byte, and the device identifier is 5 bytes.

3. The method of claim 2, wherein, The method comprises the following steps: Encrypting the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm to obtain the protection information.

4. The method of claim 1, wherein, The internal MAC packet header comprises a 2-byte protocol type field and a 12-byte address field, and the 12 bytes of the address field are used for filling part of the protection information, and the 4 bytes of the reserved field are used for filling the other part of the protection information; The hash value of the address information is 4 bytes, the timestamp is 2 bytes, the random number is 2 bytes, and the device identifier is 8 bytes.

5. The method of claim 4, wherein, The method comprises the following steps: Encrypting the hash value of the address information, the timestamp, the random number and the device identifier by using a 4-byte block cipher algorithm or an 8-byte block cipher algorithm to obtain the protection information.

6. The method according to claim 3 or 5, characterized in that, The method further comprises the following steps: Receiving a key sent by a network control center, the key is used for encryption.

7. The method according to any one of claims 1 to 5, characterized in that, The method further comprises the following steps: Receiving synchronization information sent by the network control center, the synchronization information comprises the timestamp and the random number.

8. A message authentication method characterized by comprising: The method is performed by service access components in a network, VXLAN tunnels are established between the service access components, the network is a cross-regional network constructed on an Internet or a cloud backbone network, and the method comprises the following steps: Receive a VXLAN packet, the VXLAN packet comprising a VXLAN encapsulation and a media access control (MAC) packet, the MAC packet comprising an inner MAC packet header; protection information is all located in the inner MAC packet header, or a part of the protection information is located in the inner MAC packet header and another part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation; the protection information is used to verify security of the packet, and the protection information comprises a hash value of address information, a timestamp, a random number and a device identifier; Obtain the protection information in the VXLAN packet; Verify the VXLAN packet based on the protection information.

9. A packet transmission apparatus characterized by comprising: The device is applied to service access components in a network, VXLAN tunnels are established between the service access components, and the network is a cross-region network constructed on an Internet or a cloud backbone network. An obtaining unit is configured to obtain protection information, the protection information being used to verify security of a packet, and the protection information comprising a hash value of address information, a timestamp, a random number and a device identifier. A processing unit is configured to obtain a VXLAN packet based on the protection information, the VXLAN packet comprising a VXLAN encapsulation and a media access control (MAC) packet, the MAC packet comprising an inner MAC packet header; the protection information is all located in the inner MAC packet header, or a part of the protection information is located in the inner MAC packet header and another part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation. A sending unit is configured to send the VXLAN packet.

10. A packet verification apparatus characterized by comprising: The device is applied to service access components in a network, VXLAN tunnels are established between the service access components, and the network is a cross-region network constructed on an Internet or a cloud backbone network. A receiving unit is configured to receive a VXLAN packet, the VXLAN packet comprising a VXLAN encapsulation and a media access control (MAC) packet, the MAC packet comprising an inner MAC packet header; protection information is all located in the inner MAC packet header, or a part of the protection information is located in the inner MAC packet header and another part of the protection information is located in a reserved field of a VXLAN packet header of the VXLAN encapsulation; the protection information is used to verify security of the packet, and the protection information comprises a hash value of address information, a timestamp, a random number and a device identifier. An obtaining unit is configured to obtain the protection information in the VXLAN packet. A processing unit is configured to verify the VXLAN packet based on the protection information.

11. A network device, comprising: The network device comprises a processor and a memory, the memory is configured to store a software program, and the processor is configured to run or execute the software program stored in the memory, so that the network device implements the method in any one of claims 1 to 8.

12. A message transmission system, characterized by The system comprises the message transmission device of claim 9 and the message verification device of claim 10.

13. A computer-readable storage medium, characterized in that, The computer readable storage medium is for storing program codes executed by a processor, the program codes comprising instructions for implementing the method of any one of claims 1 to 8.

14. A computer program product, characterised in that, The computer program product comprises program codes, which, when the computer program product is run by a computer, cause the computer to perform the method of any one of claims 1 to 8.

Images