Message forwarding method, device, equipment, storage medium and program product

Abstract

The embodiment discloses a message forwarding method, device, equipment, storage medium and program product. The method comprises the following steps: receiving a service message sent by a previous hop SRv6 node of the first SRv6 node; a first message header of the service message comprises segment identification (SID) information encrypted by using a key of the first SRv6 node; the first message header is decrypted by using the key of the first SRv6 node to obtain decrypted SID information, wherein the decrypted SID information at least comprises a local operation instruction of the first SRv6 node; the local operation instruction is executed; in the case that the decrypted SID information comprises an identifier of a next hop SRv6 node of the first SRv6 node, the service message is sent to the next hop SRv6 node of the first SRv6 node according to the identifier of the next hop SRv6 node of the first SRv6 node.

Description

Technical Field

[0001] This application belongs to the field of network communication technology, and specifically relates to a message forwarding method, apparatus, device, storage medium, and program product. Background Technology

[0002] Segment Routing IPv6 (SRv6), based on the Internet Protocol Version 6 (IPv6) forwarding plane, is an important future technology direction for IPv6. It supports network programmability, and relevant standards have been developed by the Internet Engineering Task Force (IETF). The overall idea of ​​SRv6 is to carry a list of Segment IDs (SIDs) in the IPv6 extension header and other packet headers, using the SIDs to execute specific functions on nodes. In the Internet, it is generally recommended to encrypt the packet payload, but the packet header is not encrypted. With SRv6, if specific traffic is subject to a special policy (SR-Policy), since the SR-Policy is usually encapsulated in the SID information of the packet header, this poses a risk of policy information leakage. Summary of the Invention

[0003] To address the problem of policy information leakage in related technologies, embodiments of this application provide a message forwarding method, apparatus, device, storage medium, and program product.

[0004] This application provides a message forwarding method applied to a first SRv6 node, the method comprising:

[0005] Receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes segment identifier (SID) information encrypted using the key of the first SRv6 node;

[0006] The first message header is decrypted using the key of the first SRv6 node to obtain the decrypted SID information, which includes at least the local operation instructions of the first SRv6 node.

[0007] Execute the local operation instruction, and if the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0008] In some embodiments, if the first header includes a preset encryption flag, it is determined that the first header includes SID information encrypted using the key of the first SRv6 node.

[0009] As can be seen, when the first message header includes a preset encryption flag, it can be determined that the first message header includes encrypted SID information. Therefore, the decrypted SID information can be obtained by decryption using the key of the first SRv6 node. Thus, in this embodiment, the decryption method of the first message header can be determined according to the preset encryption flag, thereby achieving accurate decryption of the SID information.

[0010] In some embodiments, the method further includes: if the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node, decrypting the second header of the service message using the key of the first SRv6 node; the second header carries the destination address actually accessed by the user.

[0011] It can be seen that if the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node, the first SRv6 node can be considered as the terminal node of the packet forwarding path of the service packet. At this time, the actual destination address accessed by the user can be determined by decrypting the second packet header of the service packet. Since the actual destination address accessed by the user can only be known through decryption, the confidentiality of the address of the service accessed by the user is guaranteed to a certain extent.

[0012] In some embodiments, the method further includes: if the first message header matches a predefined field of the first SRv6 node, determining that the first message header of the service message includes SID information encrypted using the key of the first SRv6 node; after decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, replacing the predefined field with a specific field, wherein the specific field is an unencrypted field in the SID information.

[0013] In some embodiments, the predefined field is an encrypted location (Locator) field, and the specific field is an unencrypted Locator field. The first SRv6 node has a pre-established association between the encrypted Locator field and the unencrypted Locator field.

[0014] The step of replacing the predefined field with a specific field includes: replacing the encrypted Locator field with the unencrypted Locator field according to the association relationship.

[0015] As can be seen, when the first message header matches the encrypted location Locator field of the first SRv6 node, it can be determined that the first message header includes encrypted SID information. Therefore, the encrypted SID information can be obtained by decryption using the key of the first SRv6 node. Furthermore, based on the association between the encrypted and unencrypted Locator fields, the encrypted Locator field can be replaced with the unencrypted Locator field. Thus, the embodiments of this application can achieve accurate decryption and restoration of SID information based on the encrypted Locator field and the association between the encrypted and unencrypted Locator fields.

[0016] In some embodiments, the method further includes: if the first message header does not match the encrypted location Locator field of the first SRv6 node, obtaining unencrypted information from the first message header, the unencrypted information including the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0017] As can be seen, in this embodiment of the application, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the message header with the encrypted Locator field. Thus, in scenarios where some nodes have encrypted SID information, it is possible to accurately determine the local operation instructions and the method for obtaining the Locator field of the next hop node.

[0018] In some embodiments, the specific field includes a decrypted Function, which represents a predefined function and includes a parameter arg field; the specific field is a Function field; replacing the predefined field with the specific field includes replacing the decrypted Function and the parameter arg field with the Function field in the decrypted SID information.

[0019] As can be seen, if the first message header matches the decryption Function field of the first SRv6 node, it can be determined that the first message header contains encrypted SID information. Therefore, it can be decrypted using the key of the first SRv6 node, thus achieving accurate decryption of the SID information.

[0020] In some embodiments, the method further includes: if the first message header does not match the decryption Function field of the first SRv6 node, obtaining unencrypted information from the first message header, the unencrypted information including local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0021] As can be seen, in this embodiment of the application, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the message header with the decryption Function field of the SRv6 node. Thus, in scenarios where some nodes have encrypted SID information, the local operation instructions and the method of obtaining the Locator field of the next-hop node can be accurately determined.

[0022] This application embodiment also provides another message forwarding method, applied in a head node, the method comprising: obtaining a service message to be sent, wherein the first message header of the service message includes SID information encrypted by the head node using the key of the target node, the target node includes at least one SRv6 node receiving the service message, and the SID information encrypted using the key of the target node includes at least the local operation instructions of the target node;

[0023] Based on the identifier of the next-hop SRv6 node of the header node carried in the first message header, the service message is sent to the target node. The target node receives the service message, decrypts the first message header using the target node's key to obtain the decrypted SID information, and executes the local operation instruction.

[0024] This application embodiment also provides a message forwarding device applied in a first SRv6 node, the device comprising:

[0025] The receiving module is configured to receive a service message sent by the previous hop SRv6 node of the first SRv6 node; the first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0026] The first processing module is used to decrypt the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, wherein the decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0027] The second processing module is used to execute the local operation instruction, and when the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, to send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0028] This application embodiment also provides another message forwarding device, applied in a header node, the device comprising:

[0029] The acquisition module is used to acquire a service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted by the key of the target node includes at least the local operation instructions of the target node.

[0030] The third processing module is used to send the service message to the target node according to the identifier of the next-hop SRv6 node of the header node carried in the first message header. The target node is used to receive the service message, decrypt the first message header using the key of the target node to obtain the decrypted SID information, and execute the local operation instruction.

[0031] This application also provides an electronic device, which includes a processor and a memory for storing a computer program that can run on the processor; wherein the processor is used to run the computer program to execute any of the above-described packet forwarding methods applied to a first SRv6 node.

[0032] This application also provides another electronic device, which includes a processor and a memory for storing a computer program that can run on the processor; wherein the processor is used to run the computer program to execute any of the above-described packet forwarding methods applied to the head node.

[0033] This application also provides a computer storage medium storing a computer program that, when executed by a processor, implements any of the above-described message forwarding methods.

[0034] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described message forwarding methods.

[0035] As can be seen, since the first header of the business message includes SID information encrypted with the key of the first SRv6 node, and policies such as SR-Policy are usually encapsulated in the SID information, it is impossible to analyze the relevant policies in the header through network attack methods. This reduces the risk of policy information leakage and improves the confidentiality and security of the business message transmission process. Attached Figure Description

[0036] Figure 1 This is a schematic diagram illustrating the format of IPv6 packets in related technologies;

[0037] Figure 2 This is a schematic diagram of SID information in related technologies;

[0038] Figure 3 This is a schematic diagram of the SRH processing procedure in related technologies;

[0039] Figure 4 This is a flowchart illustrating the forwarding of packets via SRv6 nodes in related technologies.

[0040] Figure 5 This is a flowchart illustrating a packet forwarding method applied to a first SRv6 node according to an embodiment of this application;

[0041] Figure 6 This is a flowchart illustrating the first method of forwarding packets via an SRv6 node in this application embodiment;

[0042] Figure 7 This is a flowchart illustrating the second method of forwarding packets via an SRv6 node in this application embodiment;

[0043] Figure 8 This is a flowchart illustrating the third method of forwarding packets via an SRv6 node in this application embodiment;

[0044] Figure 9 This is a flowchart illustrating the fourth method of forwarding packets via an SRv6 node in this application embodiment;

[0045] Figure 10 This is a flowchart illustrating the fifth method of forwarding packets via an SRv6 node in this application embodiment;

[0046] Figure 11 This is a flowchart illustrating the sixth method of forwarding packets via an SRv6 node in this application embodiment;

[0047] Figure 12 This is a flowchart illustrating a message forwarding method applied to a header node according to an embodiment of this application;

[0048] Figure 13 This is a schematic diagram of the structure of a packet forwarding device applied to a first SRv6 node according to an embodiment of this application;

[0049] Figure 14 This is a schematic diagram of the structure of a message forwarding device applied to a head node according to an embodiment of this application;

[0050] Figure 15 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0051] Figure 1 This is a schematic diagram of the IPv6 packet format in related technologies, for reference only. Figure 1 An IPv6 packet can include an IPv6 header, a Segment Routing Header (SRH), and an IPv6 payload. The IPv6 header can carry SID information, see [reference]. Figure 2 A 128-bit SRv6 SID can include a Locator field and a Function field (hereinafter referred to as a function or operation instruction). The Locator field is used to route to a node, and the Function field points to any possible function. For example, the Function field can carry an arg field containing the parameter. The overall idea of ​​SRv6 is to forward requests to specific nodes sequentially according to the SID list, and execute a function on the node using the SID. The SIDs are arranged in descending order in the SID list.

[0052] Reference Figure 1 The SRH (Segment Remaining Header) can include the Next Header, Header Extension Length, Routing Type, Segments Left (SL) pointer, Last Entry index, Flags field, Tag field, and Segment List (containing n+1 entries, denoted as Segment List 0 to Segment List n). Each entry carries a Segment ID (SID), which is similar in format to a 128-bit IPv6 address. As mentioned earlier, it generally includes two parts: position and function, and optionally, a parameter part. The IPv6 payload represents the effective payload of the IPv6 packet. The position parts of Segment List 0 to Segment List n represent different nodes, as shown in the reference... Figure 3 The SRH processing procedure is as follows: After the source SRv6 node sends out the IPv6 packet, it is sequentially sent through segment list n to the node corresponding to segment list 1, and finally sent to the node corresponding to segment list 0.

[0053] In related technologies, it is generally recommended to encrypt the message payload, but not the message header. After using SRv6, if a specific traffic is subject to a special policy (SR-Policy), since the SR-Policy is usually encapsulated in the message header, this will facilitate attacks on the network. This is because the relevant policies in the message header can be analyzed to infer that a user has accessed a certain service, thus bringing the risk of policy information leakage.

[0054] The following is through Figure 4 This section explains the process of forwarding packets via SRv6 nodes in related technologies, referring to... Figure 4 The IPv6 packet header (HDR) may include version, traffic class, flow label, payload length, next header, hop limit, source address, and destination address.

[0055] Reference Figure 4 The process of forwarding packets via SRv6 nodes in related technologies includes:

[0056] Step S1: Node 1 sends a message to Node 2. The message encapsulation strategy is (AN::FN, A4::F4, A2::F2)SL=2. The message encapsulation strategy means that the message first reaches Node 2 and executes the function corresponding to F2, then reaches Node 4 and executes the function corresponding to F4, and finally reaches Node N and executes the function corresponding to FN. F2, F4 and FN represent the function executed at Node 2, Node 4 and Node N, respectively.

[0057] Step S2: Node 2 receives the message, matches the SID table of Node 2's segment route (SR), executes the function corresponding to F2, decrements the value of SL by 1, updates the destination address (DA), and sends the message to Node 4.

[0058] Step S3: Node 4 receives the message, matches the SID table of Node 4's SR, executes the function corresponding to F4, decrements the value of SL by 1, updates DA, and sends the message to Node N.

[0059] Step S4: Node N receives the message, matches the SID table of Node N's SR, executes the function corresponding to FN, and processes the payload.

[0060] When encapsulating a SID list in the IPv6 header, segment routing policies (SR-Policies) can be encapsulated within the IPv6 header. Although SR-Policies can be used by many users, this user-defined information can be considered personal privacy information (because this traffic involves reaching a certain node and performing a certain operation), and it is best not to expose it to the network. However, in related technologies, since the header is not encrypted, this introduces the risk of SR-Policy leakage.

[0061] To address the aforementioned technical problems, this application proposes a technical solution based on embodiments of the present application. The approach of this application is to minimize the exposure of information in the packet header by encrypting the SID list based on an improved SRv6 mechanism. This application provides an overall approach to Encrypted SRv6 (ESRv6). In this embodiment, the information exposed in the network still includes the packet header containing the Source Address (SA) and DA. The function fields and SID list are encrypted. When the packet reaches a node, the node decrypts the SID list and updates the DA, thereby reducing the information exposed in the network. Even with the use of SRPolicy and the addition of the SRH extension header, attackers cannot decrypt the SR Policy.

[0062] In this embodiment, each node publishing a SID supports a key, and the SID list encapsulated by the header node for packet forwarding is also encrypted using the corresponding key, with the flag bit Flags1 (the first bit of the Flags field, also described below as flag b1) set to 1. Each node maintains its key locally and informs the orchestration node of the SID list (e.g., the network controller or header node) in some way.

[0063] The embodiments of this application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the embodiments provided herein are merely illustrative of the embodiments of this application and are not intended to limit the embodiments of this application. Furthermore, the embodiments provided below are some embodiments for implementing this application, and not all embodiments for implementing this application. Unless otherwise specified, the technical solutions described in the embodiments of this application can be implemented in any combination.

[0064] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a method or apparatus that includes a list of elements includes not only the elements expressly described, but also other elements not expressly listed, or elements inherent to implementing the method or apparatus. Without further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other related elements (e.g., steps in the method or units in the apparatus, such as portions of circuitry, processors, programs, or software, etc.) in the method or apparatus that includes that element.

[0065] The message forwarding method provided in this application includes a series of steps, but the message forwarding method provided in this application is not limited to the steps described. Similarly, the message forwarding device provided in this application includes a series of modules, but the device provided in this application is not limited to the modules explicitly described, but may also include modules that need to be set up for obtaining relevant information or processing based on information.

[0066] This application provides a packet forwarding method applied to a first SRv6 node, where the first SRv6 node refers to any SRv6 node in the packet forwarding path excluding the header node.

[0067] Figure 5 This is a flowchart of a packet forwarding method applied to a first SRv6 node according to an embodiment of this application, as follows: Figure 5 As shown, the process may include:

[0068] Step 501: Receive the service message sent by the previous SRv6 node of the first SRv6 node. The first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0069] Step 502: Decrypt the first message header using the key of the first SRv6 node to obtain the decrypted SID information. The decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0070] In this embodiment of the application, the decrypted SID information may include a Function field, and the local operation instruction of the first SRv6 node is the content of the Function field in the SID information.

[0071] Step 503: Execute the local operation instruction. If the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, send a service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0072] In this embodiment, if the currently processed SID is not the last SID in the SID list (SL>0 in this case), it means that the first SRv6 node is not the end node of the packet forwarding path of the service packet. The object to be decrypted is the Function field of the current SID (i.e., the SID written in DA) and the Locator field of the next-hop node. The decrypted SID information will include the identifier of the next-hop SRv6 node of the first SRv6 node. If the currently processed SID is the last SID in the SID list (SL=0 in this case), it means that the first SRv6 node is the end node of the packet forwarding path of the service packet. The object to be decrypted is the Function field of the current SID (i.e., the SID written in DA). The decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node.

[0073] In some embodiments, the identifier of the next-hop SRv6 node of the first SRv6 node may be a name, number, address or other identification information.

[0074] In some embodiments, the SID information also includes a Locator field, where the identifier of the next-hop SRv6 node of the first SRv6 node is located in the Locator field of the SID information.

[0075] In some embodiments, if the identifier of the next-hop SRv6 node of the first SRv6 node includes the next-hop SRv6 node, a service message can be sent to the next-hop SRv6 node of the first SRv6 node according to the address of the next-hop SRv6 node of the first SRv6 node.

[0076] In practical applications, steps 501 to 503 can be implemented based on a processor, which can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), Controller, Microcontroller, and Microprocessor.

[0077] As can be seen, since the first header of the business message includes SID information encrypted with the key of the first SRv6 node, and policies such as SR-Policy are usually encapsulated in the SID information, it is impossible to analyze the relevant policies in the header through network attack methods. This reduces the risk of policy information leakage and improves the confidentiality and security of the business message transmission process.

[0078] In some embodiments of this application, the method further includes: if the first message header includes a preset encryption flag, determining that the first message header includes SID information encrypted using the key of the first SRv6 node.

[0079] Here, the flag b1 bit can be carried in the first message header. When flag b1 = 1, it means that the first message header carries a preset encryption flag.

[0080] Reference Figure 6 The first process for forwarding packets via an SRv6 node in this embodiment includes:

[0081] Step 61: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNYN, X4Y4, A2::Y2)SL=2. The message encapsulation strategy means that the message first reaches Node 2 and executes the function corresponding to Y2, then reaches Node 4 and executes the function corresponding to Y4, and finally reaches Node N and executes the function corresponding to YN. Y2, Y4 and YN represent the function fields encrypted by F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0082] Step 62: Node 2 receives the message, determines that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. A2::F2 is used to match the SID table of Node 2's SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::Y4, and the message is sent to Node 4.

[0083] Step 63: Node 4 receives the message, determines that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 4 can be used to decrypt and obtain F4 and the identifier AN of the next hop SRv6 node. A4::F4 is used to match the SID table of Node 4's SR, the function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to AN::YN, and the message is sent to Node N.

[0084] Step 64: Node N receives the message, determines that flag b1 = 1 and SL = 0, and triggers the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL). At this time, the key of node N can be used to decrypt and obtain FN. AN::FN is used to match the SID table of Node N's SR, and the function corresponding to FN is executed. Then the payload of the message is processed.

[0085] It can be seen that when the first message header includes a preset encryption flag, it can be determined that the first message header includes encrypted SID information. Therefore, the decrypted SID information can be obtained by decryption using the key of the first SRv6 node. Thus, in this embodiment, the decryption method of the first message header can be determined according to the preset encryption flag, thereby achieving accurate decryption of the SID information.

[0086] In some embodiments of this application, the method further includes: decrypting the second header of the service message using the key of the first SRv6 node when the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node; the second header carries the destination address actually accessed by the user.

[0087] In some embodiments, the payload of the message may include an inner IP packet. The source address of the inner IP packet may be the user's IP address, and the destination address of the inner IP packet may be the actual destination address accessed by the user. The user's IP address can be denoted as userIP, and the actual destination address accessed by the user refers to the IP address of the service actually accessed by the user, which can be denoted as serverIP. The source and destination addresses of the inner IP packet can also be encrypted to ensure the confidentiality of the address of the service actually accessed by the user.

[0088] In some embodiments, the first header may be the user's external IPv6 header, and the source address in the first header may be the Headend IP, which may also be called the Ingress IP; the destination address in the second header may be the Endpoint IP, which may also be called the Egress IP.

[0089] In some embodiments, the second header may be the user's internal IPv6 header, which includes the source address and destination address of the inner IP packet.

[0090] Reference Figure 7 The second process for forwarding packets via an SRv6 node in this embodiment includes:

[0091] Step 71: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNYN, X4Y4, A2::Y2)SL = 2. The message encapsulation strategy means that the message first reaches Node 2, executes the function corresponding to Y2, then reaches Node 4, executes the function corresponding to Y4, and finally reaches Node N, executes the function corresponding to YN. Y2, Y4 and YN represent the encrypted function fields of F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0092] Step 72: Node 2 receives the message, determines that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. A2::F2 is used to match the SID table of SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::Y4, and the message is sent to Node 4.

[0093] Step 73: Node 4 receives the message, determines that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 4 can be used to decrypt and obtain F4 and the identifier AN of the next hop SRv6 node. A4::F4 is used to match the SID table of SR, the function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to AN::YN, and the message is sent to Node N.

[0094] Step 74: Node N receives the message, determines that flag b1=1, SL=0 and NextHeader=41, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the second message header. At this time, the key of node N can be used to decrypt, obtaining FN and the decrypted second message header. AN::FN is used to match the SID table of SR, the function corresponding to FN is executed, and then the message is forwarded according to the second message header.

[0095] As can be seen, if the first SRv6 node is the end node of the packet forwarding path of the service packet, then the decrypted SID information does not include the identifier of the next hop SRv6 node of the SRv6 node. In this case, the actual destination address accessed by the user can be determined by decrypting the second packet header of the service packet. Since the actual destination address accessed by the user can only be known through decryption, the confidentiality of the address of the service accessed by the user is guaranteed to a certain extent.

[0096] In some embodiments of this application, the method further includes: if the first message header matches a predefined field of the first SRv6 node, determining that the first message header of the service message includes SID information encrypted using the key of the first SRv6 node; after decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, replacing the predefined field with a specific field, wherein the specific field is an unencrypted field in the SID information.

[0097] In some embodiments of this application, the method further includes: if the first header matches the encrypted Locator field of the first SRv6 node, determining that the first header of the service message includes SID information encrypted using the key of the first SRv6 node; the first SRv6 node has pre-established an association between the encrypted Locator field and the unencrypted Locator field of the first SRv6 node. The unencrypted Locator field is the Locator currently used by SRv6; in these embodiments, the SRv6 node has both this ordinary Locator and extended support for encrypted Locators. The encrypted Locator indicates that the SID information (FUNCTIONG field) following the Locator is encrypted, and the optional next-hop Locator field is encrypted (the next-hop Locator field may be an encrypted Locator or an ordinary Locator).

[0098] After decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, the encrypted Locator field is replaced with the unencrypted Locator field of the first SRv6 node according to the association relationship.

[0099] Based on the aforementioned description, the presence or absence of an encrypted header can be determined by the flag b1 bit carried in the first header. If flag b1 = 1, it can be assumed that all functional fields in the SID information are encrypted (this may also include the identifier of the next-hop SRv6 node). In some embodiments, if it is deemed unnecessary to encrypt each SID, the identifier can be placed at the granularity of the SID information. In this case, a one-bit flag b1 bit is no longer needed. However, it is necessary to support SRv6 nodes in announcing specific encrypted Locator fields, and the SRv6 nodes need to associate the encrypted Locator fields with the unencrypted Locator fields. Here, the prefix of the encrypted Locator field is SLOC, and the prefix of the unencrypted Locator field is LOC.

[0100] In some embodiments, each SRv6 node advertises its own LOC and SLOC to the network to facilitate SID table matching. For example, the LOC might be B:0:0:AAA0:: / 64, and the SLOC might be B:0:0:AAA1:: / 64. This means that IPv6 packets with both prefixes will be routed to the current SRv6 node. However, if the SLOC is matched at the current SRv6 node, decryption is triggered, the corresponding function is decrypted, the prefix is ​​modified to the LOC, and the local SID table is queried again based on the LOC and the decrypted function to execute the corresponding function.

[0101] Reference Figure 8 The third process for forwarding packets via an SRv6 node in this embodiment includes:

[0102] Step 81: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNSYN, X4SY4, A2S::Y2)SL=2. The message encapsulation strategy means that the message first reaches Node 2 and executes the function corresponding to Y2, then reaches Node 4 and executes the function corresponding to Y4, and finally reaches Node N and executes the function corresponding to YN. Y2, Y4 and YN represent the encrypted function fields of F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0103] Step 82: Node 2 receives the message and determines that the LOC field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 2, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, Node 2's key can be used for decryption to obtain F2 and the identifier A4S of the next hop SRv6 node. SLOC is replaced with A2, and A2::F2 is used to match the SID table of Node 2's SR. The function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4S::Y4, and the message is sent to Node 4.

[0104] Step 83: Node 4 receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 4, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, Node 4's key can be used for decryption to obtain F4 and the identifier ANS of the next hop SRv6 node. SLOC is replaced with A4, and A4::F4 is used to match the SID table of Node 4's SR. The function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to ANS::YN, and the message is sent to Node N.

[0105] Step 84: Node N receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID. At this time, the key of Node N can be used to decrypt and obtain FN. Replace SLOC with AN, use AN::FN to match the SID table of Node N's SR, execute the function corresponding to FN, and then process the payload of the message.

[0106] As can be seen, when the first message header matches the encrypted Locator field of the first SRv6 node, it can be determined that the first message header includes encrypted SID information. Therefore, the encrypted SID information can be obtained by decryption using the key of the first SRv6 node. Furthermore, the encrypted Locator field can be replaced with the unencrypted Locator field based on the association between the encrypted and unencrypted Locator fields. Thus, the embodiments of this application can achieve accurate decryption and restoration of SID information based on the encrypted Locator field and the association between the encrypted and unencrypted Locator fields.

[0107] In some embodiments of this application, the method further includes: if the first message header does not match the encrypted Locator field of the first SRv6 node, obtaining unencrypted information from the first message header, the unencrypted information including local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node. For example, the unencrypted information may be a portion of the unencrypted SID information.

[0108] Here, if the first message header does not match the encryption Locator field of the first SRv6 node, it can be assumed that the SID information of the first SRv6 node is not encrypted. In this way, the unencrypted SID information can be obtained directly from the first message header.

[0109] In some embodiments, encryption can be refined from the encryption of all SID information to the encryption of the function of a certain SID information. Thus, it can support the encryption of the function of all SID information while also supporting the encryption of the function of some SID information. That is, it can support the encryption of the function of some SID information through a hybrid orchestration method.

[0110] In some embodiments, when encrypting the function of part of the SID information using a hybrid orchestration method, it is necessary to publish LOC and SLOC on the SRv6 node, and orchestrate the nodes where the SID information with encrypted function fields is located, such as control nodes or head nodes. In addition to recognizing LOC, it is further supported to recognize SLOC. When encrypting the SID information, SLOC is used, while LOC is used for the unencrypted function fields. At the same time, the identifier of the next-hop node of the node where the SID information with unencrypted function fields is located is not encrypted.

[0111] In some embodiments, when processing SID information with encrypted function fields, it is necessary to first determine whether it is SLOC, and if so, decrypt it before querying the local SID table, which reduces packet forwarding efficiency. Therefore, when performing functional encryption of some SID information through a hybrid orchestration method, it is supported to encrypt key function fields (key function fields can be pre-set) to improve packet forwarding efficiency. In this embodiment, the coexistence of unencrypted and encrypted nodes is supported, and some SRv6 nodes can be deployed as encrypted nodes. Here, encrypted nodes refer to SRv6 nodes that need to process encrypted function fields, and unencrypted nodes refer to SRv6 nodes that can directly obtain unencrypted function fields from the first packet header. SRv6 nodes that support encryption also support partial traffic encryption (using SLOC) and partial traffic unencryption (using LOC).

[0112] Reference Figure 9 The fourth process for forwarding packets via an SRv6 node in this embodiment includes:

[0113] Step 91: Node 1 sends a message to Node 2. The message encapsulation strategy is (ANSYN, X4F4, A2S::Y2)SL=2. The message encapsulation strategy means that the message first reaches Node 2 and executes the function corresponding to Y2, then reaches Node 4 and executes the function corresponding to F4, and finally reaches Node N and executes the function corresponding to YN. Y2 and YN represent the function fields obtained after encrypting F2 in Node 2 and FN in Node N, respectively.

[0114] Step 92: Node 2 receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 2, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. Replace SLOC with A2, use A2::F2 to match the SID table of SR, execute the function corresponding to F2, decrement the value of SL by 1, update the destination address to A4::F4, and send the message to Node 4.

[0115] Step 93: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches the unencrypted Locator field and Function field of Node 4. That is, A4::F4 can be used to match the SID table of SR, execute the function corresponding to F4, decrement the value of SL by 1, update the destination address to ANS::YN, and send the message to Node N.

[0116] Step 94: Node N receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) in the first message header matches the encrypted Locator field of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID. At this time, the key of Node N can be used to decrypt and obtain FN. Replace SLOC with AN, use AN::FN to match the SID table of SR, execute the function corresponding to FN, and then process the payload of the message.

[0117] As can be seen, in this embodiment, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the Locator field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) with the encrypted Locator field. This allows for accurate determination of how to obtain SID information and is beneficial for obtaining SID information in scenarios where some nodes have encrypted SID information.

[0118] In some embodiments of this application, the encrypted local operation instructions of the first SRv6 node are located in the Function field of the SID information or in the arg field of the parameter.

[0119] The method further includes: if the current SID in the first packet header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches the decryption function of the first SRv6 node (the local SID table stores all local function fields, and the matching of these function fields is performed according to the longest matching principle, similar to the longest matching in IP forwarding), determining that the first packet header of the service packet includes SID information encrypted using the key of the first SRv6 node; the decryption function is a predefined function.

[0120] When the first message header is decrypted using the key of the first SRv6 node, the specific objects to be decrypted are the arg field of the current SID and the Locator field, which may include the next SID. After obtaining the SID information, the decryption Function field and the parameter arg field are replaced with the Function field in the SID information.

[0121] In the aforementioned embodiments, SRv6 nodes need to advertise the following two prefixes: SLOC and LOC. However, since the SID list orchestration node, such as the controller or head node, cannot directly determine which prefix in the advertised information is SLOC, it needs to determine whether the received LOC is the original LOC or SLOC according to the convention. Simultaneously, it needs to associate the SLOC with the corresponding LOC to achieve correct SID list orchestration. To address this issue, in some embodiments, if it is deemed unnecessary to encrypt each SID, it can be identified at the granularity of the SID information. In this case, it is no longer necessary to occupy a one-bit flag b1 flag, but a special Function space needs to be defined; that is, the SRv6 node can advertise only the LOC, but a special decryption Function needs to be defined. For example, the LOC is B:0:0:AAA0:: / 64, and the last 64 bits of the Segment ID are programming space used by the Function field. When the decryption Function in the Function field occupies 1 bit, the last 63 bits of the Function field can be used for network programming, and the programming space becomes B:0:0:AAA0:0000:: / 65. The prefix of all encrypted function fields is B:0:0:AAA0:8000:: / 65. At this time, the SID information includes the LOC, a 1-bit decryption Function field, and an arg field.

[0122] Reference Figure 10 The fifth process for forwarding packets via an SRv6 node in this embodiment includes:

[0123] Step 101: Node 1 sends a message to Node 2. The message encapsulation strategy is (XN1YN, X41Y4, A2::1Y2)SL = 2. The meaning of the message encapsulation strategy is that first, the message reaches Node 2, and the function corresponding to Y2 is executed; then it reaches Node 4, and the function corresponding to Y4 is executed; finally, it reaches Node N, and the function corresponding to YN is executed. Y2, Y4, and YN represent the parameter arg obtained after encrypting the last 63 bits of F2 in Node 2, the last 63 bits of F4 in Node 4, and the last 63 bits of FN in Node N, respectively. After decryption, Y2 can be the last 63 bits of F2, Y4 can be the last 63 bits of F4, and YN can be the last 63 bits of FN. At this time, Y2, Y4, and YN are all 63 bits, and F2, F4, and FN are all 64 bits, but the first bit of F2, F4, and FN is 0.

[0124] Step 102: Node 2 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches Node 2's decryption function, and triggers the decryption of the first message header. Specifically, the objects to be decrypted are the arg field of the current SID and the Locator field of the next SID. At this time, Node 2's key can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. The decryption function and arg field are replaced with F2, and A2::F2 is used to match the SID table of Node 2's SR. The function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::1Y4, and the message is sent to Node 4.

[0125] Step 103: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches the decryption function of Node 4, and triggers the decryption of the first message header. Specifically, the objects to be decrypted are the arg field of the current SID and the LOC field of the next SID. At this time, the key of Node 4 can be used to decrypt, obtain F4 and the identifier AN of the next hop SRv6 node, replace the decryption function and arg field with F4, use A4::F4 to match the SID table of Node 4's SR, execute the function corresponding to F4, decrement the value of SL by 1, update the destination address to AN::1YN, and send the message to Node N.

[0126] Step 104: Node N receives the message and determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches the decryption Function field of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the arg field of the current SID. At this time, SL = 0, and there is no next SID. At this point, the key of Node N can be used to decrypt and obtain FN. The decryption Function and arg fields are replaced with FN, and AN::FN is used to match the SID table of SR. The function corresponding to FN is executed, and then the payload of the message is processed.

[0127] It can be seen that when the current SID in the first message header matches the decryption function of the first SRv6 node (this matching includes the LOC portion and the decryption function; for example, the current SID in the first message header can match B:0:0:AAA0:8000:: / 65, and the arg field does not need to be matched), it can be determined that the first message header contains encrypted SID information. Therefore, it can be decrypted using the key of the first SRv6 node, and the SID information can be accurately decrypted.

[0128] In some embodiments of this application, the method further includes: when the first message header does not match the decryption function of the first SRv6 node, but can directly match a normal function, unencrypted information can be obtained from the first message header. The unencrypted information includes local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node. For example, the unencrypted information may be a portion of the unencrypted SID information.

[0129] In some embodiments, in schemes that define a specific programming space, partial SID information can also be encrypted using a hybrid orchestration approach.

[0130] Reference Figure 11 The sixth process for forwarding packets via an SRv6 node in this embodiment includes:

[0131] Step 111: Node 1 sends a message to Node 2. The message encapsulation strategy is (AN1YN, X4F4, A2::1Y2)SL = 2. The message encapsulation strategy means that first, the message reaches Node 2, where the function corresponding to Y2 is executed; then it reaches Node 4, where the function corresponding to F4 is executed; and finally, it reaches Node N, where the function corresponding to YN is executed. Y2 and YN represent the parameter arg obtained after encryption by F2 at Node 2 and FN at Node N, respectively. After decryption, Y2 can be the last 63 bits of F2, and after decryption, YN can be the last 63 bits of FN. At this time, Y2 and YN are both 63 bits, and F2 and FN are both 64 bits, but the first bit of F2 and FN is 0.

[0132] Step 112: Node 2 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches Node 2's decryption function, and triggers the decryption of the first message header. Specifically, the objects to be decrypted are the arg field of the current SID and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. The decryption function and arg field are replaced with F2, A2::F2 is used to match the SID table of SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::F4, and the message is sent to Node 4.

[0133] Step 113: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches Node 4's F4. That is, A4::F4 can be used to match the SID table of SR, execute the function corresponding to F4, decrement the value of SL by 1, update the destination address to AN::1YN, and send the message to Node N.

[0134] Step 114: Node N receives the message, determines that the current SID in the first message header (i.e., the SID written in DA) matches the decryption function of node N, and triggers the decryption of the first message header. Specifically, the object to be decrypted is the arg field of the current SID. At this time, the key of node N can be used to decrypt and obtain FN. The decryption function and arg field are replaced with FN. AN::FN is used to match the SID table of SR, and the function corresponding to FN is executed to process the payload of the message.

[0135] As can be seen, in this embodiment, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the current SID of the message header with the decryption function of the SRv6 node. This allows for accurate determination of the method for obtaining SID information and is beneficial for obtaining SID information in scenarios where some nodes have encrypted SID information.

[0136] This application's embodiments can be applied to fields such as transmission and bearer. In the technical solutions of this application's embodiments, the head node or other network nodes encrypt or decrypt the SID information, exposing only information similar to the SRH extension header (e.g., SA, DA, etc.). In some embodiments, the SID information can be given an identifier indicating that it is ESRv6 SID information; the SID information can be encrypted by: using the target SRv6 node's key to encrypt the FUNCT field of the target SRv6 node's SID and the next-hop Locator field of the target SRv6 node, or by using the target SRv6 node's key to encrypt the function field and the second header of the target SRv6 node's SID information. In some embodiments, a special SLOC or decryption function can be defined to indicate whether encryption is required.

[0137] The technical solution adopted in this application embodiment can encrypt the specific information of the SID list, which is beneficial to the encryption protection of policy information in computing power networks and the confidentiality of policies in application-aware networks. Network attackers cannot determine what network capabilities a user used (because the SID information is encrypted) or what services they accessed by analyzing packets. The mechanism for encrypting SID information in this application embodiment can be used between network ingress and egress nodes, and also between Broadband Network Gateway (BNG) and Headend, to protect the user's true DA. Compared with the SID information encryption mechanism in related technologies, this application embodiment can also encrypt the FUNCT field, resulting in better confidentiality.

[0138] This application provides a message forwarding method applied to the head node.

[0139] Figure 12 This is a flowchart of a packet forwarding method applied to the head node according to an embodiment of this application, such as... Figure 12 As shown, the process may include:

[0140] Step 121: Obtain the service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted using the key of the target node includes at least the local operation instructions of the target node.

[0141] Step 122: Send the service message to the target node. The target node receives the service message, decrypts the first message header using its key to obtain the decrypted SID information, and executes local operation instructions.

[0142] Here, when the target node is the next-hop SRv6 node of the head node, the service message can be sent to the target node according to the identifier of the next-hop SRv6 node of the head node carried in the first message header; when the target node is not the next-hop SRv6 node of the head node, the service message can be sent to the target node through routing node forwarding.

[0143] As can be seen, since the first header of the business message includes SID information encrypted with the target node's key, and policies such as SR-Policy are usually encapsulated in the SID information, it is impossible to analyze the relevant policies in the header through network attack methods. This reduces the risk of policy information leakage and improves the confidentiality and security of the business message transmission process.

[0144] Those skilled in the art will understand that, in the above-described method of the specific implementation, the order in which each step is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0145] Figure 13 This is a schematic diagram of the packet forwarding device applied to the first SRv6 node according to an embodiment of this application, as shown below. Figure 13 As shown, the device includes:

[0146] The receiving module 131 is used to receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0147] The first processing module 132 is used to decrypt the first message header using the key of the first SRv6 node to obtain the decrypted SID information, wherein the decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0148] The second processing module 133 is used to execute the local operation instruction, and when the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, to send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0149] In some embodiments, the first processing module 132 is further configured to determine that the first message header includes SID information encrypted using the key of the first SRv6 node, if the first message header includes a preset encryption flag.

[0150] In some embodiments, the first processing module 132 is further configured to decrypt the second header of the service message using the key of the first SRv6 node when the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node; the second header carries the destination address actually accessed by the user.

[0151] In some embodiments, the first processing module 132 is further configured to determine, when the first message header matches a predefined field of the first SRv6 node, that the first message header includes SID information encrypted using the key of the first SRv6 node; after decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, replace the predefined field with a specific field, wherein the specific field is an unencrypted field in the SID information.

[0152] In some embodiments, the predefined field is an encrypted location Locator field, and the specific field is an unencrypted Locator field. The first SRv6 node has a pre-established association relationship between the encrypted Locator field and the unencrypted Locator field. The first processing module 132 is used to replace the predefined field with the specific field by replacing the encrypted Locator field with the unencrypted Locator field according to the association relationship.

[0153] In some embodiments, the first processing module 132 is further configured to obtain unencrypted information from the first message header if the first message header does not match the encrypted Locator field of the first SRv6 node. The unencrypted information includes the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0154] In some embodiments, the specific field includes a decrypted Function, which represents a predefined function and includes a parameter arg field; the specific field is a Function field; the first processing module 132 replaces the predefined field with the specific field, including: replacing the decrypted Function and the parameter arg field with the Function field in the decrypted SID information.

[0155] In some embodiments, the first processing module 132 is further configured to obtain unencrypted information from the first message header if the first message header does not match the decryption Function field of the first SRv6 node. The unencrypted information includes the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0156] In practical applications, the receiving module 131, the first processing module 132, and the second processing module 133 can be implemented based on a processor and a communication device.

[0157] Figure 14 This is a schematic diagram of the structure of a message forwarding device applied to the head node according to an embodiment of this application, as shown below. Figure 14 As shown, the device includes:

[0158] The acquisition module 141 is used to acquire a service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted by the key of the target node includes at least the local operation instructions of the target node.

[0159] The third processing module 142 is used to send the service message to the target node. The target node is used to receive the service message, decrypt the first message header using the target node's key to obtain the decrypted SID information, and execute the local operation instruction.

[0160] In practical applications, the acquisition module 141 and the third processing module 142 can be implemented based on a processor and a communication device.

[0161] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0162] It should be noted that, in the embodiments of this application, if the above methods are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a terminal, server, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0163] Correspondingly, this application embodiment further provides a computer program product, the computer program product including computer executable instructions, which are used to implement any of the message forwarding methods provided in this application embodiment.

[0164] Accordingly, this application embodiment further provides a computer storage medium storing computer-executable instructions, which are used to implement any of the message forwarding methods provided in the above embodiments.

[0165] This application also provides an electronic device. Figure 15This is a schematic diagram of the composition structure of an electronic device provided in an embodiment of this application, as shown below. Figure 15 As shown, the electronic device 150 may include:

[0166] Memory 151 is used to store executable instructions;

[0167] The processor 152 is used to implement any of the above-described message forwarding methods when executing the executable instructions stored in the memory 151.

[0168] The processor 152 mentioned above can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0169] The aforementioned computer-readable storage medium and memory 152 may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; or it may be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0170] In some embodiments, the functions or modules of the apparatus provided in this application can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0171] The description of the various embodiments above tends to emphasize the differences between the various embodiments. The similarities or similarities between them can be referred to, and for the sake of brevity, they will not be repeated here.

[0172] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined to obtain new method embodiments without conflict.

[0173] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0174] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0175] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0176] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A message forwarding method, characterized in that, The method, applied to a first segmented routing SRv6 node based on the Internet Protocol version 6 (IPv6) forwarding plane, includes: Receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes segment identifier (SID) information encrypted using the key of the first SRv6 node; The first message header is decrypted using the key of the first SRv6 node to obtain the decrypted SID information, which includes at least the local operation instructions of the first SRv6 node. Execute the local operation instruction, and if the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node. The method further includes: if the first message header matches a predefined field of the first SRv6 node, determining that the first message header of the service message includes SID information encrypted using the key of the first SRv6 node; After decrypting the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, the predefined field is replaced with a specific field, which is the unencrypted field in the SID information; The predefined field is an encrypted location Locator field, and the specific field is an unencrypted Locator field. The first SRv6 node has a pre-established association between the encrypted Locator field and the unencrypted Locator field. The step of replacing the predefined field with a specific field includes: replacing the encrypted Locator field with the unencrypted Locator field according to the association relationship; If the first message header does not match the encrypted Locator field of the first SRv6 node, unencrypted information is obtained from the first message header. The unencrypted information includes the local operation instruction and the Locator field of the next-hop node of the first SRv6 node.

2. The method according to claim 1, characterized in that, The method further includes: if the first message header includes a preset encryption flag, determining that the first message header includes SID information encrypted using the key of the first SRv6 node.

3. The method according to claim 1 or 2, characterized in that, The method further includes: if the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node, decrypting the second header of the service message using the key of the first SRv6 node; the second header carries the destination address actually accessed by the user.

4. The method according to claim 1, characterized in that, The specific field includes a decryption function, which represents a predefined function and contains a parameter arg field; the specific field is a function field. The step of replacing the predefined field with a specific field further includes: replacing the decryption Function and parameter arg fields with the Function field in the decrypted SID information.

5. The method according to claim 4, characterized in that, The method further includes: if the first message header does not match the decryption Function field of the first SRv6 node, obtaining unencrypted information from the first message header, wherein the unencrypted information includes the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

6. A message forwarding device, characterized in that, The apparatus, applied to a first segmented routing SRv6 node based on the Internet Protocol version 6 (IPv6) forwarding plane, comprises: The receiving module is configured to receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes segment identifier (SID) information encrypted using the key of the first SRv6 node. The first processing module is used to decrypt the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, wherein the decrypted SID information includes at least the local operation instructions of the first SRv6 node. The second processing module is used to execute the local operation instruction, and when the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, it sends the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node. The first processing module is further configured to determine, when the first message header matches a predefined field of the first SRv6 node, that the first message header of the service message includes SID information encrypted using the key of the first SRv6 node. After decrypting the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, the predefined field is replaced with a specific field, which is the unencrypted field in the SID information; The predefined field is an encrypted location Locator field, and the specific field is an unencrypted Locator field. The first SRv6 node has a pre-established association between the encrypted Locator field and the unencrypted Locator field. The step of replacing the predefined field with a specific field includes: replacing the encrypted Locator field with the unencrypted Locator field according to the association relationship; If the first message header does not match the encrypted Locator field of the first SRv6 node, unencrypted information is obtained from the first message header. The unencrypted information includes the local operation instruction and the Locator field of the next-hop node of the first SRv6 node.

7. An electronic device, characterized in that, In a segmented routing SRv6 node applied to the first Internet Protocol version 6 (IPv6) forwarding plane, the electronic device includes a processor and a memory for storing computer programs capable of running on the processor; wherein, The processor is used to run the computer program to perform the method according to any one of claims 1 to 5.

8. A computer storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the method described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5.

Images