Secure message transmission method and related device

Abstract

The invention provides a method for safely transmitting a message, a method for negotiating IPsec SA and a related device, which are applied to a wide area network. In the scene of crossing multiple sections of tunnels, IPsec SA for end-to-end security protection is negotiated between a first site edge and a second site edge based on VRF granularity by expanding BGP routing. The method comprises the following steps: after a first site edge performs security protection on a VPN service message on the basis of an IPsec SA, sending the message through an overlay end-to-end tunnel between the first site edge and a second site edge, and processing the message on the basis of the IPsec SA by the second site edge to obtain the VPN service message. According to the method and the device, security protection only needs to be performed once at the first site edge, and the intermediate node does not need to be encrypted and decrypted, so that the secure transmission of the message is ensured, the transmission efficiency is improved, and the transmission delay is reduced.

Description

Technical Field

[0001] The present application relates to the field of wide area network message transmission, and in particular to a method for securely transmitting messages and a method for negotiating IPsec SA and related devices. Background Art

[0002] Based on the underlying network, an overlay network can be constructed by establishing tunnels between multiple network nodes. The overlay network decouples the service from the underlying network, enabling end-to-end rapid delivery of service messages.

[0003] However, since the tunnel is established based on the operator network, the network cannot guarantee the security of the service message. Therefore, the tunnel itself needs to have certain security capabilities to ensure the security of the service message. The currently commonly used method is that when establishing a tunnel on the control plane, the ingress node and the egress node of the tunnel negotiate a key based on the transport network port (TNP) granularity through the border gateway protocol (BGP), wherein the key is bound to the port of the ingress node and the port of the egress node of the tunnel. After the tunnel is established, when the service message is transmitted in the tunnel, the ingress node encrypts the service message according to the key negotiated with the egress node, so that the service message is in an encrypted state when transmitted in the tunnel. When the service message reaches the egress node of the tunnel, the egress node decrypts the service message according to the negotiated key, thereby ensuring the security of the service message transmission.

[0004] The above-mentioned method of encrypting and decrypting messages based on the TNP granularity of network nodes requires the negotiation of key information between the ingress node and the egress node for each tunnel segment. When the service message is transmitted in the tunnel segment, it is encrypted in the negotiated manner at the ingress node of the tunnel segment and decrypted in the negotiated manner at the egress node. When the service flow needs to cross multiple tunnel segments, the keys between the tunnel segments are different. It is necessary to encrypt at the ingress node of each tunnel segment, decrypt at the egress node, encrypt again at the ingress node of the next tunnel segment, and decrypt again at the egress node... The encryption and decryption operations are cumbersome and consume a large amount of computing resources of the device, increasing the forwarding delay of the service message. Summary of the invention

[0005] The present application provides a method for securely transmitting messages, a method for negotiating IPsec SA, and related devices. The method described in the present application can improve message transmission efficiency and reduce transmission delay.

[0006] In a first aspect, the present application provides a method for securely transmitting a message, which is described from the sending side of a data forwarding plane, and the method includes:

[0007] The first site egress device edge in the wide area network receives the virtual private network VPN service message in the virtual routing forwarding VRF;

[0008] The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;

[0009] The first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound endpoint of the overlay end-to-end tunnel, the second site edge is an outbound endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0010] The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.

[0011] In the scheme of the present application, in a scenario where multiple tunnels are spanned between the edge of the first site and the edge of the second site, the edge of the first site and the edge of the second site have pre-negotiated an IPsecSA associated with the VRF. After the edge of the first site receives the VPN service message in the VRF, the edge of the first site performs security protection on the VPN service message according to the IPsecSA associated with the VRF negotiated with the edge of the second site to obtain a first message; then, the tunnel information of the upper-layer overlay end-to-end tunnel established between the edge of the first site and the edge of the second site is encapsulated in the outer layer of the first message to obtain a second message; then, the edge of the first site transmits the second message to the edge of the second site through the upper-layer overlay end-to-end tunnel, wherein each POP through which the overlay end-to-end tunnel passes does not need to decrypt or encrypt the second message, but only needs to forward it according to the tunnel information.

[0012] In a scenario where multiple tunnels are spanned between the edge of a first site and the edge of a second site, the present application provides a method for securely transmitting messages. This method only requires one security protection at the entry point of the overlay end-to-end tunnel established between the edges of the two sites. During the transmission process, each POP does not need to encrypt or decrypt the message, which saves computing resources, reduces transmission delays, and improves message transmission efficiency.

[0013] Based on the first aspect, in a possible implementation, the security protection of the VPN service message includes: encrypting the VPN service message using the Encapsulating Security Payload (ESP) protocol; and / or encapsulating the VPN service message with an Authentication Header.

[0014] Based on the first aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0015] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

[0016] The overlay end-to-end tunnel can be an SRv6 tunnel. The first site edge encapsulates the tunnel information of the SRv6 tunnel in the outer layer of the first message. The tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH. Each POP on the tunnel can forward the second message according to the IPv6 header and the segment routing header SRH.

[0017] Based on the first aspect, in a possible implementation, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.

[0018] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0019] Based on the first aspect, in a possible implementation, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0020] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0021] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.

[0022] Based on the first aspect, in a possible implementation manner, before the first site edge receives the service message, the method further includes:

[0023] The first site edge receives the Border Gateway Protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; according to the route type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

[0024] A new route type is added to BGP routing, which carries IPsec SA and Export RT. The newly added route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the VPN service messages in the VRF that matches the Export RT. Through the BGP route announcement, the IPsecSA associated with the VRF is negotiated between the edge of the first site and the edge of the second site. The IPsecSA is used to provide security protection for the VPN service messages in the VRF, especially when multiple tunnels are spanned between the edge of the first site and the edge of the second site, which lays the foundation for the secure and fast transmission of the VPN service messages. The implementation of the embodiment of the present application realizes the secure and fast transmission of VPN service messages, reduces the transmission delay, and improves the transmission efficiency.

[0025] Based on the first aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0026] Based on the first aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0027] Based on the first aspect, in a possible implementation manner, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0028] Based on the first aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0029] Based on the first aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0030] Based on the first aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.

[0031] In a second aspect, the present application provides a method for securely transmitting a message, which is described from the receiving side of a data forwarding plane, and the method includes:

[0032] A second site egress device edge in a wide area network receives a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;

[0033] The second site edge decapsulates the second message to obtain the first message;

[0034] The second site edge processes the first message according to the IPsecSA to obtain the VPN service message.

[0035] After the second site edge receives the second message, the second message includes the first message and the tunnel information encapsulated in the outer layer of the first message. The second site edge decapsulates the second message to obtain the first message, and then processes the first message according to the IPsecSA negotiated with the first site edge to obtain the VPN service message. During the entire transmission process, the second message does not need to be encrypted or decrypted by each POP on the overlay end-to-end tunnel, but only needs to be processed once at the second site edge, which improves transmission efficiency and reduces transmission delay.

[0036] Based on the second aspect, in a possible implementation method, the processing of the first message includes: decrypting the first message using the Encapsulated Security Payload ESP protocol according to the IPsecSA; and / or authenticating the first message based on the authentication data carried in the IPsec SA and the authentication header Authentication Header of the first message.

[0037] Based on the second aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0038] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

[0039] Based on the second aspect, in a possible implementation method, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.

[0040] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0041] Based on the second aspect, in a possible implementation manner, the first information is a first node SID of the first POP, and the operation associated with the first node SID includes:

[0042] An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

[0043] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0044] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.

[0045] Based on the second aspect, in a possible implementation, before the second-site export device edge in the wide area network receives the second message sent by the first-site edge through the upper-layer overlay end-to-end tunnel, the method also includes: the second-site export device edge generates a Border Gateway Protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second-site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; the second-site edge announces the BGP route to the first-site edge.

[0046] Based on the second aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0047] Based on the second aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0048] Based on the second aspect, in a possible implementation manner, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0049] Based on the second aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0050] Based on the second aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0051] Based on the second aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.

[0052] In a third aspect, the present application provides a method for negotiating an Internet Protocol Security Alliance (IPsec SA), described from the receiving side of the control plane, the method comprising:

[0053] The first site egress device edge in the wide area network receives a border gateway protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;

[0054] According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

[0055] This application scheme adds a new route type RT to BGP routing. The BGP routing carries IPsec SA and export routing target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT. By announcing the BGP routing in the WAN, the end-to-end IPsec SA negotiation based on VRF granularity is realized between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages.

[0056] Based on the third aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0057] Based on the third aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0058] It can be understood that the site ID and the node ID can uniquely identify a node.

[0059] Based on the third aspect, in a possible implementation manner, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0060] Based on the third aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0061] Based on the third aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0062] Based on the third aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0063] In a fourth aspect, the present application provides a method for negotiating an Internet Protocol Security Alliance (IPsec SA), described from the sending side of the control plane, the method comprising:

[0064] The second site egress device edge in the wide area network generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;

[0065] The second site edge announces the BGP route to the first site edge.

[0066] This application scheme adds a new route type RT to BGP routing. The BGP routing carries IPsec SA and export routing target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT. By announcing the BGP routing in the WAN, the end-to-end IPsec SA negotiation based on VRF granularity is realized between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages.

[0067] Based on the fourth aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0068] Based on the fourth aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0069] Based on the fourth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0070] Based on the fourth aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0071] Based on the fourth aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0072] Based on the fourth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0073] In a fifth aspect, the present application provides a device for securely transmitting a message, the device being applied to a first site egress device edge in a wide area network, the device comprising:

[0074] A receiving module, used for receiving a virtual private network VPN service message in a virtual routing forwarding VRF;

[0075] a processing module, configured to perform security protection on the VPN service message according to an Internet Protocol Security Alliance (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;

[0076] The processing module is used to encapsulate tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0077] A sending module is used to send the second message to the second site edge through the overlay end-to-end tunnel.

[0078] Based on the fifth aspect, in a possible implementation, the processing module is used to: perform Encapsulating Security Payload ESP protocol encryption on the VPN service message; and / or encapsulate an Authentication Header on the VPN service message.

[0079] Based on the fifth aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0080] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

[0081] Based on the fifth aspect, in a possible implementation method, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overly SRv6 Policy from the first POP to the second POP according to the next-hop SID of the END.SID.

[0082] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0083] Based on the fifth aspect, in a possible implementation method, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0084] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0085] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.

[0086] Based on the fifth aspect, in a possible implementation method, the receiving module is also used to receive the Border Gateway Protocol BGP route announced by the second site edge, the BGP route including the route type RT, the IPsec SA, the identifier of the second site edge, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF that matches the Export RT; the processing module is also used to associate the IPsec SA with the VRF according to the route type RT and the Export RT.

[0087] Based on the fifth aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0088] Based on the fifth aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0089] Based on the fifth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0090] Based on the fifth aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0091] Based on the fifth aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0092] Based on the fifth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.

[0093] Each functional module in the fifth aspect is used to implement the method described in the above-mentioned first aspect and any possible implementation method of the first aspect.

[0094] In a sixth aspect, the present application provides a device for securely transmitting a message, the device being applied to a second site edge in a wide area network, characterized in that the device comprises:

[0095] a receiving module, configured to receive a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes a first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;

[0096] A processing module, used for decapsulating the second message to obtain a first message;

[0097] The processing module is further configured to process the first message according to the IPsecSA to obtain the VPN service message.

[0098] Based on the sixth aspect, in a possible implementation method, the processing module is used to: decrypt the first message using the Encapsulated Security Payload ESP protocol according to the IPsecSA; and / or authenticate the first message based on the authentication data carried in the IPsec SA and the authentication header Authentication Header of the first message.

[0099] Based on the sixth aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0100] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

[0101] Based on the sixth aspect, in a possible implementation method, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overly SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.

[0102] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a segmented routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0103] Based on the sixth aspect, in a possible implementation method, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0104] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0105] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.

[0106] Based on the sixth aspect, in a possible implementation,

[0107] The processing module is also used to generate a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual route forwarding VRF matching the Export RT;

[0108] A sending module is used to notify the BGP route to the first site edge.

[0109] Based on the sixth aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0110] Based on the sixth aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0111] Based on the sixth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0112] Based on the sixth aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0113] Based on the sixth aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0114] Based on the sixth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0115] Each functional module in the sixth aspect is used to implement the method described in the above-mentioned second aspect and any possible implementation method of the second aspect.

[0116] In a seventh aspect, the present application provides a device for negotiating an Internet Protocol Security Alliance (IPsec SA), the device being applied to a first site edge in a wide area network, the device comprising:

[0117] A receiving module, configured to receive a Border Gateway Protocol (BGP) route announced by an edge of a second site, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the edge of the second site, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;

[0118] A processing module is used to associate the IPsec SA with the VRF according to the routing type RT and the Export RT.

[0119] Based on the seventh aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0120] Based on the seventh aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0121] Based on the seventh aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0122] Based on the seventh aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0123] Based on the seventh aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0124] Based on the seventh aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0125] Each functional module in the seventh aspect is used to implement the method described in the third aspect and any possible implementation method of the third aspect.

[0126] In an eighth aspect, the present application provides a device for negotiating an Internet Protocol Security Alliance (IPsec SA), the device being applied to a second site edge in a wide area network, the device comprising:

[0127] A processing module, configured to generate a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on a service message in a virtual route forwarding VRF matching the Export RT;

[0128] The sending module is used to notify the BGP route to the first site edge.

[0129] Based on the eighth aspect, in a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0130] Based on the eighth aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0131] Based on the eighth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0132] Based on the eighth aspect, in a possible implementation manner, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0133] Based on the eighth aspect, in a possible implementation manner, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0134] Based on the eighth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.

[0135] The various functional modules in the eighth aspect are used to implement the method described in the fourth aspect and any possible implementation method of the fourth aspect.

[0136] In a ninth aspect, the present application provides a network device, comprising a memory and a processor, the memory being used to store instructions, and the processor being used to execute the instructions stored in the memory to implement the method described in the first aspect and any possible implementation of the first aspect, or to implement the method described in the second aspect and any possible implementation of the second aspect, or to implement the method described in the third aspect and any possible implementation of the third aspect, or to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0137] In the tenth aspect, the present application provides a system, including a first site exit device edge and a second site edge, the first site edge is used to execute the method described in the first aspect and any possible implementation of the first aspect, and the second site edge is used to execute the method described in the second aspect and any possible implementation of the second aspect; or, the first site edge is used to execute the method described in the third aspect and any possible implementation of the third aspect, and the second site edge is used to execute the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0138] In the eleventh aspect, the present application provides a computer storage medium, characterized in that it includes program instructions, which, when executed on a processor, enable the processor to implement the method described in the first aspect and any possible implementation of the first aspect, or enable the processor to implement the method described in the second aspect and any possible implementation of the second aspect, or enable the processor to implement the method described in the third aspect and any possible implementation of the third aspect, or enable the processor to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0139] In the twelfth aspect, the present application provides a computer program product comprising program instructions. When the program instructions are executed on a processor, the processor implements the method described in the first aspect and any possible implementation of the first aspect, or the processor implements the method described in the second aspect and any possible implementation of the second aspect, or the processor implements the method described in the third aspect and any possible implementation of the third aspect, or the processor implements the method described in the fourth aspect and any possible implementation of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0140] Figure 1 A schematic diagram of a scenario provided for this application;

[0141] Figure 2 A flowchart of a method for negotiating an IPsec SA provided in this application;

[0142] Figure 3 A partial structural diagram of a BGP SD-WAN routing message provided for this application;

[0143] Figure 4 A partial structural diagram of a BGP EVPN routing message provided for this application;

[0144] Figure 5 A flowchart of a method for securely transmitting messages provided in this application;

[0145] Fig. 6A A schematic diagram of the structure of a VPN service message provided for this application;

[0146] Figure 6B A schematic diagram of the structure of the first message provided for this application;

[0147] Figure 6C A schematic diagram of the structure of the second message provided for this application;

[0148] Figure 7 A schematic diagram of the structure of a second message provided by this application;

[0149] Figure 8 A schematic diagram of the structure of another second message provided by the present application;

[0150] Fig. 9 A flowchart of a method for securely transmitting messages provided in this application;

[0151] Fig.10 A schematic diagram of the structure of a device for securely transmitting messages provided in this application;

[0152] Fig.11 A schematic diagram of the structure of another device for securely transmitting messages provided by the present application;

[0153] Fig.12 A schematic diagram of the structure of a network device provided for this application. DETAILED DESCRIPTION

[0154] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0155] See also Figure 1 , Figure 1 A schematic diagram of a scenario provided for this application. Figure 1 In the software-defined wide-area network (SD-WAN) shown, SD-WAN tunnels are established between points of presence (POPs) in the underlay network, tunnel 1 is established between customer premises equipment (CPE) 1 and edge point of presence (EPOP) 1, tunnel 2 is established between EPOP1 and backbone point of presence (BPOP) 1, tunnel 3 is established between BPOP1 and BPOP2, tunnel 4 is established between BPOP2 and EPOP2, and tunnel 5 is established between EPOP2 and CPE2, wherein CPE1 is located at site 1 and CPE2 is located at site 2. The ingress and egress nodes of each tunnel are key negotiated based on TNP granularity.

[0156] In an application scenario, according to actual business needs, the business flow (business message) needs to go from CPE1 to CPE2, that is, the business message needs to be transmitted from CPE1 to CPE2 across multiple tunnels. First, the CPE1 node encrypts the business message according to the key agreed upon between CPE1 and EPOP1 on tunnel 1. When the business message is transmitted to the EPOP1 node, the EPOP1 node decrypts the message according to the agreed key; when the business message reaches tunnel 2, the EPOP 1 node encrypts the business message according to the key agreed upon between EPOP1 and BPOP1 on tunnel 2. When the business message is transmitted to the BPOP1 node, the BPOP1 node decrypts the business message according to the agreed key; ... until the message is transmitted to tunnel 5, the EPOP 2 node encrypts the business message according to the key agreed upon between EPOP2 and CPE2 on tunnel 5. When the business message is transmitted to the CPE2 node, the CPE2 node decrypts the business message according to the agreed key, parses the message, and obtains the data.

[0157] For this application scenario that requires transmission across multiple tunnels, multiple encryption and decryption steps are required, which is cumbersome and consumes computing resources of network devices, increasing the forwarding delay of business messages.

[0158] The present application provides a method for negotiating an Internet Protocol Security (IPsec) Security Association (SA), which is applied to a wide area network. IPsec SA is a security protocol used to provide confidentiality, integrity and identity authentication of data on an IP network. IPsec SA is a set of security parameters established between two network devices to protect the transmission of IP data packets. It includes encryption algorithms, identity authentication protocols, key lengths, key management and other security parameters. Before IPsec SA is established, the two devices must negotiate security parameters to ensure that they use the same security parameters. Once IPsec SA is established, data packets will be encrypted and authenticated using these security parameters to ensure the confidentiality and integrity of the data.

[0159] See also Figure 2 As shown, Figure 2 A flowchart of a method for negotiating an IPsec SA provided in the present application, wherein the method includes but is not limited to the description of the following content.

[0160] S101. The second site egress device edge in the wide area network generates a BGP route, where the BGP route includes a route type RT, an IPsec SA, an identifier of the second site edge, and an export route target ExportRT.

[0161] BGP routing includes a route distinguisher (RD) and an export route target (ExportRoute Target, referred to as Export RT). The route distinguisher RD is used to identify the virtual routing forwarding (VRF) of the second site edge, and the export route target Export RT is used to perform VRF matching of the second site edge.

[0162] The BGP route also includes the identifier of the second site edge. In one implementation, the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and the node identifier Node ID of the second site edge, that is, the edge can be determined by the site identifier and the node identifier. In another implementation, the node identifier in the wide area network is globally unique. In this case, the identifier of the second site edge can only include the node identifier, that is, the edge can be uniquely determined by the node identifier.

[0163] BGP routing also includes routing type (Route Type, RT) and IPsec SA. The routing type RT indicates that the IPsec SA announced by the BGP routing is used to provide end-to-end security protection for the service packets in the virtual routing forwarding VRF that matches the export routing target Export RT. For example, if the VRF that matches the export routing target Export RT is the VRF of the first site edge, the routing type RT indicates that the IPsec SA announced by the BGP routing is used to provide end-to-end security protection for the service packets between the second site edge and the first site edge.

[0164] Optionally, the BGP route can be a BGP SD-WAN route, the sub-address family of the BGP route is the SD-WAN sub-address family, and the BGP route can also be a BGP Ethernet virtual private network (EVPN) route, and the sub-address family of the BGP route is the EVPN sub-address family. The BGP route can also be other routes, and its sub-address family can be other sub-address families, which is not limited in this application.

[0165] BGP routes include network layer reachability information (NLRI), where the route type RT, route distinguisher RD, and the identifier of the second site edge are all located in the NLRI. Figure 3 , Figure 3A partial structural diagram of a BGP SD-WAN routing provided for this application, Figure 3 In the , Route Type indicates the route type RT, which can be 2 bytes long. In the SD-WAN sub-address family, the route type can be defined as 2. RouteDistinguisher indicates the route distinguisher RD, which can be 8 bytes long. SD-WAN-Color is used to indicate the site identifier, which can be 4 bytes long. SD-WAN-Node-ID is used to indicate the node identifier, which can be 4 bytes or 16 bytes long. For another example, see Figure 4 , Figure 4 A partial structural diagram of a BGP EVPN routing provided in this application, Figure 4 In the Figure 3 The meanings of the various fields in the schematic diagram are the same, except that in the EVPN sub-address family, the route type RT is defined as 10. It should be noted that defining the route type RT as 2 here is only an example in the SD-WAN sub-address family. Other values ​​can also be used in the SD-WAN address family to represent the newly added route type. Defining the route type RT as 10 is only an example of the EVPN sub-address family. Other values ​​can also be used in the EVPN address family to represent the newly added route type, and this application does not make specific limitations.

[0166] BGP routing also includes type-length-value (TLV for short). Specifically, BGP routing includes Tunnel Encapsulation Attribute (TEA) TLV, wherein TEA TLV includes IPsec SA, that is, IPsec SA is carried in the TEA TLV field of BGP routing. Specifically, IPsec SA is carried in the sub-TLV of TEATLV. BGP routing also includes extended community attribute TLV, and the extended community attribute TLV includes export routing target Export RT, that is, Export RT is carried in the extended community attribute TLV field of BGP routing. It should be noted that the location of IPsec SA and Export RT here is an example. IPsec SA and Export RT can also be carried in other TLV fields of BGP routing, which is not specifically limited in this application.

[0167] For example, in Figure 1 In the wide area network scenario diagram shown, the second site edge may be CPE1 or CPE2.

[0168] S102. The second site edge announces the BGP route to the first site edge.

[0169] The second site edge advertises the BGP route in the WAN. For example, Figure 1 In the wide area network shown, it is assumed that the second site edge is CPE1. After CPE1 generates the BGP route, it can reflect the BGP route to EPOP1 through the regional route reflector (RR). EPOP1 reflects the BGP route to BPOP1, BPOP2 and EPOP2 through the managed service provider (MSP) RR. EPOP2 then reflects the BGP route to CPE2 through the regional RR, thereby realizing the notification of BGP routes.

[0170] The first site edge in the wide area network receives the BGP route advertised by the second site edge. For example, Figure 1 In the example, if the edge of the second site is CPE1, the edge of the first site may be CPE2; if the edge of the second site is CPE2, the edge of the first site may be CPE1.

[0171] S103. According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

[0172] The first site edge receives the BGP route announced by the second site edge, and associates the IPsec SA with the VRF according to the route type RT and the export route target Export RT in the BGP route. Specifically, Export RT is used to match the VRF of the second site edge, and the route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF that matches the Export RT. Therefore, after receiving the BGP route, the first site edge first determines whether the VRF of its own site matches the Export RT. If they match, the first site edge associates the IPsec SA with the VRF of the first site edge. Because the IPsec SA is also associated with the second site edge, it can be understood that the VRF of the first site edge and the VRF of the second site edge are both associated with the IPsec SA. If they do not match, the first site edge is not associated with the IPsec SA.

[0173] In one implementation, the matching strategy can be set as follows. An import route target and an export route target Export RT can be set in each edge in the wide area network, wherein the import route target is stored locally in the edge, and the export route target is carried in the BGP route. The BGP route sent by the second site edge carries the export route target. After the first site edge receives the BGP route sent by the second site, it compares the export route target in the BGP route with the import route target stored locally in the first site edge. If the two are consistent, the VRF of the first site edge matches the Export RT in the BGP route, and the first site edge associates the IPsec SA in the BGP route with the VRF of the first site edge. If the two are inconsistent, the VRF of the first site edge does not match the Export RT in the BGP route, and the IPsec SA is not associated with the VRF of the first site edge. For example, the Export RT carried in the BGP route sent by the second site edge is 100, and the local import route target of the first site edge is 100. After receiving the BGP route, the first site edge compares the ExportRT with the local import route target. After comparison, if the two are consistent, the first site edge associates the IPsec SA carried in the BGP route with the VRF of the first site edge. This is only one possible implementation method of the matching strategy. The matching strategy can also be implemented in other ways, which is not limited in this application.

[0174] The method described in this application can be applied to a wide area network, such as a software defined wide area network SD-WAN, where the first site edge and the second site edge can be site edges in the SD-WAN. The method described in this application can also be applied to other wide area networks, which is not limited in this application.

[0175] In actual applications, the first site edge and the second site edge can be determined according to actual business needs and business flows, and the import routing target and export routing target of the first site edge, as well as the import routing target and export routing target of the second site edge can be set according to actual business needs.

[0176] It can be understood that after the BGP routing announcement, the VRF of the edge of the first site and the VRF of the edge of the second site are associated with the IPsec SA, that is, the IPsec SA used to transmit business messages has been negotiated between the edge of the first site and the edge of the second site. When business messages are subsequently transmitted between the edge of the first site and the edge of the second site, the business messages can be securely protected based on the negotiated IPsec SA, and the VPN business messages can be transmitted through the virtual routing forwarding VRF, thereby realizing end-to-end tunnel transmission between the edge of the first site and the edge of the second site, which only requires one security protection and one decapsulation process, thereby reducing transmission delay.

[0177] It can be seen that the present application provides a method for negotiating IPsec SA, adding a new route type in BGP routing, and carrying IPsec SA and export route targets in BGP routing. The newly added route type is used to indicate that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF that matches the export target route. The newly added route type implements IPsec SA negotiation based on VRF granularity. Through the announcement of BGP routing, an IPsec SA method is negotiated between the edge of the first site and the edge of the second site, so that when the service packets are subsequently transmitted between the edge of the first site and the edge of the second site, the service packets can be securely protected based on the negotiated IPsec SA method, and the VPN service packets can be transmitted by means of virtual routing forwarding VRF.

[0178] Based on the above-mentioned IPsec SA negotiation method, the present application also provides a method for securely transmitting messages. Figure 5 , Figure 5 A flow chart of a method for securely transmitting messages provided in the present application, the method is applied to a wide area network, and the method includes but is not limited to the description of the following content.

[0179] S201. A first site egress device edge in a wide area network receives a virtual private network VPN service message in a virtual routing forwarding VRF.

[0180] The first site egress device edge in the wide area network receives the VPN service message in the VRF, wherein the VPN service message may be sent to the first site edge by the controller, or may be sent to the first site edge by other network devices in the wide area network.

[0181] exist Figure 1 In the scenario diagram shown, the first site edge may be CPE1 or CPE2.

[0182] S202. The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Alliance (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message.

[0183] Through BGP routing announcement, IPsecSA is negotiated between the edge of the first site and the edge of the second site, and the VRF of the edge of the first site and the VRF of the edge of the second site are associated with IPsecSA. IPsecSA is used to provide end-to-end protection for the service messages between the VRF of the edge of the first site and the VRF of the edge of the second site. Based on this, after the edge of the first site receives the VPN service message in the VRF, the edge of the first site performs security protection on the VPN service message according to the IPsecSA associated with the VRF negotiated with the edge of the second site, and obtains the first message.

[0184] In one implementation, the security protection of VPN service messages includes encrypting the VPN service messages using the encapsulate security payload (ESP) protocol. In one implementation, the security protection of VPN service messages includes encapsulating the VPN service messages with an authentication header (AH). In one implementation, the security protection of VPN service messages includes encrypting the VPN service messages using the ESP protocol and encapsulating the VPN service messages with an authentication header AH. The security protection of VPN service messages can also be implemented in other ways, which are not limited in this application.

[0185] S203. The first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message.

[0186] The first site edge encapsulates the tunnel information of the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message. The underlying underlay tunnel corresponding to the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple tunnel segments. For example, Figure 1In the scenario diagram shown, if the edge of the first site is CPE1 and the edge of the second site is CPE2, the underlying underlay tunnels corresponding to the overlay end-to-end tunnel between the edge of the first site and the edge of the second site include tunnel 1 (CPE1 to EPOP1), tunnel 2 (EPOP1 to BPOP1), tunnel 3 (BPOP1 to BPOP2), tunnel 4 (BPOP2 to EPOP2) and tunnel 5 (EPOP2 to CPE2).

[0187] The overlay end-to-end tunnel includes at least one entry point POP, and the tunnel information includes information about at least one entry point. In one example, the overlay end-to-end tunnel includes a entry point POP, which is called the first entry point POP for ease of description, wherein the first site edge is the entry point of the overlay end-to-end tunnel, the second site edge is the exit point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first entry point POP, which can be either an EPOP or a BPOP, which is not limited in this application. The tunnel information of the overlay end-to-end tunnel includes first information about the first entry point.

[0188] In another example, the overlay end-to-end tunnel includes multiple points of presence POPs, the multiple points of presence POPs include a first point of presence POP and a second point of presence POP, wherein the first site edge is an entry point of the overlay end-to-end tunnel, the second site edge is an exit point of the overlay end-to-end tunnel, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP. Figure 1 In the scenario diagram shown, if the first site edge is CPE1 and the second site edge is CPE2, the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple access points. The first site edge accesses the WAN through EPOP1, and the second site edge accesses the WAN through EPOP2. Then EPOP1 is the first POP and EPOP2 is the second POP. The tunnel information of the overlay end-to-end tunnel includes first information of the first access point and second information of the second access point.

[0189] In one implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the Internet Protocol version 6 (IPv6), and the first site edge encapsulates the tunnel information of the SRv6 tunnel outside the first message to obtain a second message. The second message includes an IPv6 header and a segment routing header (SRH). In the case where the overlay end-to-end tunnel includes a first access point and a second access point, the destination address of the IPv6 header points to the first access point, and the SRH includes the first information and the second information.

[0190] For example, see FIG. 6A to FIG. 6C As shown, FIG. 6A to FIG. 6C An example diagram provided for this application. Fig. 6A It represents VPN service packets, including the packet header Inner IP Hdr and the load Inner Payload. Figure 6B It represents the first message, which is obtained by encrypting the VPN service message using the ESP protocol. Figure 6C It represents the second message, which is obtained after encapsulating the tunnel information of the SRv6 tunnel between the first site edge and the second site edge outside the first message, wherein IPv6 Hdr (Src IP, Dst IP) represents the IPv6 message header, SRH (…, vpnsid) represents the segment routing header SRH, and the IPv6 message header and SRH constitute part of the tunnel information of the overlay end-to-end tunnel.

[0191] For example, in Figure 1 In the scenario diagram shown, assuming that CPE1 is the edge of the first site, CPE2 is the edge of the second site, and the overlay end-to-end tunnel between CPE1 and CPE2 is an SRv6 tunnel, CPE1 encapsulates the tunnel information of the SRv6 tunnel between CPE1 and CPE2 outside the first message to obtain the second message. Figure 7 As shown, Figure 7A schematic diagram provided for this application. When at CPE1, in the second message, IPv6 HDR (cpe1, epop1-sid) is the IPv6 message header, SRH (vpnsid, epop2-sid, bpop2-sid, bpop1-sid, epop1-sid,) is the segment routing header SRH, wherein epop1-sid represents the first endpoint segment identifier END.SID of CPE1, bpop1-sid represents the first endpoint segment identifier END.SID of BPOP1, bpop2-sid represents the first endpoint segment identifier END.SID of BPOP2, epop2-sid represents the first endpoint segment identifier END.SID of EPOP2, vpnsid is generated by CPE2 during BGP route announcement, and vpnsid is associated with the VRF of CPE2. Among them, EPOP1 is the first access point POP, the first endpoint segment identifier epop1-sid of EPOP1 is the first information of the first access point POP, EPOP2 is the second access point POP, the first endpoint segment identifier epop2-sid of EPOP2 is the second information of the second access point POP, and the operations associated with the first endpoint segment identifier epop1-sid of EPOP1 include: matching the upper layer overly SRv6 policy Policy from the first POP to the second POP according to the next hop SID of epop1-sid. Figure 7 The messages at each POP point shown can show the operations associated with the segment identifier END.SID.

[0192] The upper layer overlay network is built on the basis of the lower layer underlay network. When the second message is transmitted through the overlay end-to-end tunnel, it is actually transmitted on the lower layer underlay network. However, the upper layer overlay network does not perceive how the message is transmitted on the lower layer underlay network. Therefore, it is necessary to encapsulate the tunnel information of the underlay tunnel in the outer layer of the second message, and the message encapsulated with the tunnel information of the underlay tunnel is transmitted through the overlay end-to-end tunnel (the message actually encapsulated with the tunnel information of the underlay tunnel is transmitted on the lower layer underlay tunnel.) For example, Figure 1 In the scenario shown, since the wide area network is an SD-WAN, the message needs to pass through the operator network when it is transmitted. The devices in the operator network cannot recognize the upper-layer overly IPv6 address. Therefore, a layer of the underlying underlay tunnel message header underlay IP is encapsulated in the outer layer.

[0193] In one implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engine (SR-MPLS TE) policy, and the second message includes an MPLS label stack, and the MPLS label stack includes first information of the first POP and second information of the second POP. Among them, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0194] For example, in Figure 1 In the scenario diagram shown, it is assumed that CPE1 is the edge of the first site, CPE2 is the edge of the second site, and the overlay end-to-end tunnel between CPE1 and CPE2 is an SR-MPLS TE Policy. Then, CPE1 encapsulates the SR-MPLS TE Policy information between CPE1 and CPE2 outside the first message to obtain the second message. Figure 8 As shown, Figure 8 A schematic diagram provided for the present application. When at CPE1, in the second message, (epop1-sid, bpop1-sid, bpop2-sid, epop2-sid, cpe2-sid) represents the tunnel information of the overlay end-to-end tunnel, that is, the MPLS label stack, wherein epop1-sid represents the first node SID of EPOP1, bpop1-sid represents the first node SID of BPOP1, bpop2-sid represents the first node SID of BPOP2, epop2-sid represents the first node SID of EPOP2, and cpe2-sid represents the first node SID of CPE2. EPOP1 is the first access point POP, the first node segment identifier epop1-sid of EPOP1 is the first information of the first access point POP, EPOP2 is the second access point POP, and the first node segment identifier epop2-sid of EPOP2 is the second information of the second access point POP. The operation of associating the first node SID includes: matching the upper layer overly SR MPLS tunnel between the first POP and the second POP according to the next hop SID of the first node SID in the label stack, Figure 8 The messages at each POP point shown can show the operations associated with the node segment identifier SID. Figure 8 The underlay IP in the message is the tunnel information of the underlay tunnel.

[0195] In another implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second message can be tunnel encapsulated based on the generic network virtualization encapsulation (GENEVE) protocol, and the second message is encapsulated using SRv6 in GENEVE. Exemplarily, the second message includes: an outer IP header, a user datagram protocol (UDP) header, a GENEVE encapsulation, an SRH, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message; the GENEVE encapsulation includes a VPN identifier of the VPN service carried by the VPN service message. In one example, a metadata field may also be included between the SRH and ESP to carry service intent information. Of course, the second message can also use SRv6 over GENEVE encapsulation. The difference between SRv6 over GENEVE encapsulation and SRv6 inGENEVE encapsulation is that an IPv6 header is also included between the GENEVE encapsulation and the SRH. The encapsulation overhead of SRv6 over GENEVE encapsulation is larger than that of SRv6 in GENEVE encapsulation, but SRv6 over GENEVE encapsulation complies with the standard encapsulation format of SRv6.

[0196] In another implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the generic routing encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE. In one example, the second message includes: an outer IP header, a UDP header, an outer GRE encapsulation, an IPv6 header, an SRH, an inner GRE encapsulation, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message; the inner GRE encapsulation includes the VPN identifier of the VPN service carried by the VPN service message. The VPN identifier is carried in the inner GRE encapsulation. When the second message is transmitted in the network, the intermediate nodes passed by the overlay end-to-end tunnel do not resolve the VPN identifier (VPN identifier, VNI), that is, the intermediate nodes are not aware of the VPN. In one example, a metadata field may also be included between the SRH and the inner GRE encapsulation to carry service intent information.

[0197] The business intention information in the embodiment of the present application may include one or more information indicating the business intention. In one example, the business intention information may include a quality of service parameter, and the quality of service parameter is not limited to one or more parameters such as latency, packet loss, jitter, bandwidth utilization, and bit error rate. In another example, the business intention parameter may include gateway constraint information that needs to be satisfied by the end-to-end path from site edge1 to site edge2, and the gateway constraint information includes but is not limited to the gateways that need to be passed through and / or the gateways that need to be detoured.

[0198] S204. The first site edge sends a second message to the second site edge through the overlay end-to-end tunnel.

[0199] The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel. In a possible implementation, the first site edge sends the second message to the second site edge through the SRv6 tunnel or the SR-MPLS TE Policy.

[0200] It should be noted that each access point POP between the first site edge and the second site edge does not perceive the second message, does not decrypt the second message, and only forwards it according to the tunnel information of the overlay end-to-end tunnel until the second message reaches the second site edge. Therefore, during the transmission of the service message, only one security protection needs to be performed at the edge of the first site, and no decryption is required at other access points POP, which reduces the consumption of computing resources, improves forwarding efficiency, and reduces transmission delay.

[0201] The method for securely transmitting messages provided in this embodiment can be applied to SD-WAN, and the first site edge and the second site edge are site edges in the SD-WAN. The method can also be applied to other wide area networks, which is not limited in this application.

[0202] The present application scheme adds a new route type RT to BGP routing. The BGP routing carries IPsec SA and export routing target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT. By announcing the BGP routing in the wide area network, the end-to-end IPsec SA negotiation based on VRF granularity is achieved between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages. Compared with the existing IPsec SA negotiation based on TNP granularity, each access point POP between the edge of the first site and the edge of the second site does not perceive the inner VPN service message. Through the end-to-end encryption and decryption between the edges of the two sites, the consumption of computing resources is reduced, the forwarding efficiency is improved, and the transmission delay is reduced.

[0203] Based on the above-mentioned IPsecSA negotiation method and secure message transmission method, the present application also provides a secure message transmission method. Fig. 9 , Fig. 9 A flowchart of a method for securely transmitting messages provided in the present application, the method includes but is not limited to the description of the following content.

[0204] S301. The second site edge in the wide area network receives a second message sent by the first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge. The second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in the outer layer of the first message.

[0205] In the present embodiment, the method for securely transmitting messages can be applied in SD-WAN, the first site edge and the second site edge are site edges in SD-WAN, and the method can also be applied to other wide area networks, which is not limited in this application.

[0206] The second site egress device edge receives the second message sent by the first site edge through the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge. The lower layer underlay tunnel corresponding to the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge includes multiple tunnel segments. For example, see Figure 1In the scenario diagram shown, the first site edge may be CPE1, and the second site edge may be CPE2; or, the first site edge may be CPE2, and the second site edge may be CPE1. The underlying underlay tunnel corresponding to the overlay end-to-end tunnel established between CPE1 and CPE2 includes multiple tunnels, specifically including: tunnel 1 (CPE1 to EPOP1), tunnel 2 (EPOP1 to BPOP1), tunnel 3 (BPOP1 to BPOP2), tunnel 4 (BPOP2 to EPOP2), and tunnel 5 (EPOP2 to CPE2).

[0207] The overlay end-to-end tunnel includes at least one access point POP, and the tunnel information includes information about at least one access point. In one example, the overlay end-to-end tunnel includes a first access point POP, and the tunnel information includes first information about the first access point. In another example, the overlay end-to-end tunnel includes multiple access points POPs, and the multiple access points POPs include a first access point POP and a second access point POP, and the tunnel information includes first information about the first access point and second information about the second access point. Among them, the first site edge is the entry point of the overlay end-to-end tunnel, and the second site edge is the exit point of the overlay end-to-end tunnel. The first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0208] In one implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second site edge receives the second message sent by the first site edge through the SRv6 tunnel. The second message includes the first message and the tunnel information of the SRv6 tunnel encapsulated in the outer layer of the first message. The first message is a message obtained by performing security protection on the VPN service message through the IPsecSA negotiated between the second site edge and the first site edge. The tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH. The destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information. For the formats of the service message, the first message, and the second message, please refer to FIG. 6A to FIG. 6C For the sake of brevity of the description, the schematic diagram shown will not be described in detail here.

[0209] In one implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy, and the second message includes the first message and the SR-MPLS TE Policy information encapsulated in the outer layer of the first message. The SR-MPLS TE Policy information includes an MPLS label stack, and the MPLS label stack includes the first information of the first POP and the second information of the second POP. For the format of the second message, please refer to the description of the above method embodiment, and for the sake of brevity of the specification, it will not be repeated here.

[0210] In a possible implementation, the second message may also include a message header of the underlying underlay tunnel. Figure 1 In the SD-WAN scenario shown, since the message needs to pass through the operator network during transmission, the devices in the operator network cannot recognize the upper-layer overly IPv6 address. Therefore, a layer of the underlying underlay tunnel message header underlay IP is encapsulated in the outer layer.

[0211] S302. The second site edge decapsulates the second message to obtain the first message.

[0212] The second site edge decapsulates the second message to obtain the first message. In one implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second message includes the first message and the tunnel information of the SRv6 tunnel. The second site edge decapsulates the second message, removes the tunnel information of the SRv6 tunnel, and obtains the first message. The schematic diagram of the first message format is shown in FIG. Figure 6B As shown, no further description is given here.

[0213] In one implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy, and the second message includes the first message and the SR-MPLS TE Policy information encapsulated in the outer layer of the first message. The second site edge decapsulates the second message, removes the tunnel information of the MPLS SR-TE tunnel, and obtains the first message. The schematic diagram of the first message format is shown in FIG. Figure 6B As shown, no further description is given here.

[0214] In one implementation, the overlay end-to-end tunnel is a GENEVE protocol encapsulated tunnel, and the second message is encapsulated using SRv6 in GENEVE. The second site edge decapsulates the second message, removes the SRv6 in GENEVE encapsulated message header, and obtains the first message. The schematic diagram of the first message format is shown in FIG. Figure 6B As shown, no further description is given here.

[0215] In another implementation, the overlay end-to-end tunnel is a tunnel based on GRE protocol encapsulation, and the second message is encapsulated using SRv6 over GRE. The second site edge decapsulates the second message, removes the SRv6 over GRE encapsulated message header, and obtains the first message. Figure 6B As shown, no further description is given here.

[0216] S303: The second site edge processes the first message according to the IPsecSA to obtain a virtual private network VPN service message.

[0217] In one implementation, the second site edge performs ESP protocol processing on the first message according to IPsecSA to obtain a VPN service message. In one implementation, the second site edge authenticates the first message according to IPsecSA and the authentication data carried in the authentication header AH of the first message to obtain a VPN service message. In one implementation, the second site edge performs ESP protocol decryption on the first message according to IPsecSA, and authenticates the first message according to the IPsecSA and the authentication data carried in the authentication header AH of the first message to obtain a VPN service message.

[0218] It should be noted that the first site edge can generate a BGP route and notify the second site edge of the BGP route, or the second site edge can generate a BGP route and notify the BGP route to the first site edge. Both methods can achieve the association of the VRF of the first site edge and the VRF of the second site edge with the IPsec SA. After the VRF of the first site edge and the VRF of the second site edge are associated with the IPsec SA in either of the two methods, the first site edge can perform security protection and encapsulation on the VPN service message based on the negotiated IPsec SA, and then send it to the second site edge, which will decapsulate and decrypt it according to the negotiated IPsec SA to obtain the VPN service message.

[0219] It can be seen that the present application provides a method for securely transmitting messages. Through BGP routing announcements, the IPsec SA is negotiated between the edge of the first site and the edge of the second site, and the IPsec SA is associated with the VRF of the edge of the first site and the VRF of the edge of the second site. When transmitting VPN service messages across multiple tunnel scenarios, it is only necessary to perform security protection on the VPN service message at the edge of the first site according to the negotiated IPsec SA to obtain the first message, and then encapsulate the tunnel information of the overlay end-to-end tunnel established between the edge of the first site and the edge of the second site outside the first message to obtain the second message, and send the second message to the edge of the second site through the overlay end-to-end tunnel.

[0220] In the scenario of transmission across multiple underlay tunnels, only one IPsec SA security protection needs to be performed at the edge of the first site, and one IPsec SA processing needs to be performed at the edge of the second site. Each access point in the middle does not need to encrypt or decrypt the message, but only needs to forward it according to the tunnel information. Therefore, the implementation of the embodiment of the present application reduces the consumption of computing resources of network nodes, improves forwarding efficiency, and reduces transmission delay.

[0221] The above is a description of the method embodiment provided in the present application. The following is a device embodiment corresponding to the method embodiment provided in the present application.

[0222] See also Fig.10 , Fig.10 The present application provides a structural diagram of a device 600 for securely transmitting a message according to an embodiment. The device 600 for securely transmitting a message can be configured as a first site edge in a wide area network. The device 600 includes:

[0223] A receiving module 610 is used to receive a virtual private network VPN service message in a virtual routing forwarding VRF;

[0224] The processing module 620 is used to perform security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;

[0225] The processing module 620 is further configured to encapsulate tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, and the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0226] The sending module 630 is used to send a second message to the second site edge through the overlay end-to-end tunnel.

[0227] In a possible implementation, the processing module 620 is used to: perform Encapsulating Security Payload (ESP) protocol encryption on the VPN service message; and / or encapsulate an Authentication Header on the VPN service message.

[0228] In a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.

[0229] In a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes first information and second information.

[0230] In a possible implementation, the first information is a first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching an upper layer overlay SRv6 Policy from the first POP to the second POP according to a next hop SID of the END.SID.

[0231] In a possible implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0232] In a possible implementation, the first information is a first node SID of the first POP, and the operation of associating the first node SID includes: matching an upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0233] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0234] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0235] In a possible implementation, the receiving module 610 is also used to receive the Border Gateway Protocol BGP route announced by the edge of the second site, the BGP route including the route type RT, IPsec SA, the identifier of the edge of the second site, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection for the VPN service packets in the virtual routing forwarding VRF matching the Export RT; the processing module 620 is used to associate the IPsec SA with the VRF according to the route type RT and the Export RT.

[0236] In a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0237] In a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0238] In a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes a route type RT and an identifier of the second site edge.

[0239] In a possible implementation, the BGP route includes a tunnel encapsulation attribute type-length-value TunnelEncapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.

[0240] In a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry ExportRT.

[0241] In a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0242] The apparatus 600 for securely transmitting a message can be used to implement Figure 5 The corresponding method embodiment, that is, the method embodiment corresponding to the data forwarding plane sending side, can also be used to implement Figure 2 The method steps performed by the first site edge in the method embodiment, that is, the method embodiment corresponding to the control plane receiving side, can be specifically referred to Figure 2 or Figure 5 For the sake of brevity, the specific contents of the method embodiments are not described here. When the apparatus 600 for securely transmitting messages is used to implement the method embodiment corresponding to the control plane receiving side, the apparatus 600 for securely transmitting messages can also be called an apparatus for negotiating IPsec SA.

[0243] Understandably, Fig.10 The division of the functional modules and the corresponding execution steps of the functional modules are merely examples. In other embodiments, the device 600 may be divided into more or fewer functional modules according to specific execution steps.

[0244] See also Fig.11 , Fig.11 A schematic diagram of the structure of another apparatus 700 for securely transmitting a message provided in an embodiment of the present application, wherein the apparatus 700 for securely transmitting a message can be configured as a second site edge in a wide area network, and the apparatus 700 includes:

[0245] The receiving module 710 is used to receive a second message sent by the first site edge through the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in the outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of the first point of presence POP, the first site edge is the inbound end point of the overlay end-to-end tunnel, the second site edge is the outbound end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;

[0246] The processing module 720 is used to decapsulate the second message to obtain the first message;

[0247] The processing module 720 is used to process the first message according to the IPsecSA to obtain a VPN service message.

[0248] In a possible implementation, the processing module 720 is used to: perform encapsulating security payload ESP protocol decryption on the first message according to IPsecSA; and / or authenticate the first message according to the IPsec SA and the authentication data carried in the authentication header of the first message.

[0249] In a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.

[0250] In a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes first information and second information.

[0251] In a possible implementation, the first information is a first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching an upper layer overlay SRv6 Policy from the first POP to the second POP according to a next hop SID of the END.SID.

[0252] In a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0253] In a possible implementation, the first information is a first node SID of the first POP, and the operation of associating the first node SID includes: matching an upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0254] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0255] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0256] In a possible implementation,

[0257] The processing module 720 is used to generate a border gateway protocol BGP route, wherein the BGP route includes a route type RT, an IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on VPN service packets in a virtual route forwarding VRF matching the Export RT;

[0258] The sending module 730 is used for the second site edge to notify the BGP route to the first site edge.

[0259] In a possible implementation, the BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0260] In a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0261] In a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes a route type RT and an identifier of the second site edge.

[0262] In a possible implementation, the BGP route includes a tunnel encapsulation attribute type-length-value TunnelEncapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.

[0263] In a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry ExportRT.

[0264] In a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0265] The apparatus 700 for securely transmitting a message can be used to implement Fig. 9 The corresponding method embodiment, that is, the method embodiment corresponding to the receiving side of the data forwarding plane, can also be used to implement Figure 2The method steps performed by the second site edge in the corresponding method embodiment, that is, the method embodiment corresponding to the control plane sending side. For details, please refer to Figure 2 or Fig. 9 For the sake of brevity, the specific contents of the method embodiments are not described here. When the apparatus 700 for securely transmitting messages is used to implement the method embodiment corresponding to the control plane sending side, the apparatus 700 for securely transmitting messages can also be called an apparatus for negotiating IPsec SA.

[0266] Understandably, Fig.11 The division of the functional modules and the corresponding execution steps of the functional modules are merely examples. In other embodiments, the device 700 may be divided into more or fewer functional modules according to specific execution steps.

[0267] See also Fig.12 , Fig.12 This is a schematic diagram of the structure of a network device 800 provided in the present application, the network device 800 can be configured as a first site edge in a wide area network, or can be configured as a second site edge in a wide area network. The network device 800 can be implemented by a general bus architecture.

[0268] The network device 800 includes at least one processor 801 , a memory 803 , and at least one communication interface 804 .

[0269] The processor 801 may be a general-purpose CPU, NP, microprocessor, or may be one or more integrated circuits for implementing the solution of the present application. For example, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. Among them, the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0270] The network device 800 may also include a communication bus 802 for transmitting information between various components. The communication bus 802 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0271] The memory 803 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 803 may exist independently and be connected to the processor 801 through the communication bus 802; the memory 803 may also be integrated with the processor 801.

[0272] The communication interface 804 is used to communicate with other devices or communication networks. The communication interface 804 may include a wired communication interface and may also include a wireless communication interface. The wired communication interface may be, for example, an Ethernet interface, and the Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0273] In a specific implementation, as an embodiment, the processor 801 may include one or more CPUs, for example, Fig.12 CPU0 and CPU1 are shown in the figure.

[0274] In a specific implementation, as an embodiment, the network device 800 may include multiple processors, such as Fig.12 801 and processor 805 shown in . Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0275] In some embodiments, the memory 803 is used to store the program code 810 of the present application solution, and the processor 801 is used to execute the program code 810 stored in the memory 803. That is, the network device 800 can implement the program code 810 in the processor 801 and the memory 803. Figure 2 or Figure 5 or Fig. 9 The method provided in the method embodiment.

[0276] The network device 800 of the embodiment of the present application may correspond to the first site edge or the second site edge in the above-mentioned various method embodiments, and the processor 801, the communication interface 804, etc. in the network device 800 may implement the functions and / or various steps and methods implemented by the devices in the above-mentioned various method embodiments. For the sake of brevity, it will not be repeated here.

[0277] When the network device 800 is configured as the first site edge, corresponding to the above-mentioned device 600 for securely transmitting messages, the receiving module 610 and the sending module 630 in the device 600 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 620 can be located in the processor 801 or the processor 805 in the network device 800.

[0278] When the network device 800 is configured as the second site edge, corresponding to the above-mentioned device 700 for securely transmitting messages, the receiving module 710 and the sending module 730 in the device 700 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 720 can be located in the processor 801 or the processor 805 in the network device 800.

[0279] The hardware, modules and other operations and / or functions in the network device 800 are respectively various steps and methods implemented by the device 600 for securely transmitting messages or the device 700 for securely transmitting messages. For detailed processes such as how the network device 800 implements message processing, the specific details can be found in the above-mentioned method embodiments, and for the sake of brevity of the specification, they will not be repeated here.

[0280] Among them, the above Figure 2 or Figure 5 or Fig. 9 Each step is completed by an integrated logic circuit of hardware or software instructions in the processor of the network device 800. The method and steps disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules (software units) in the processor. The software module can be located in one or more storage media mature in the art such as random access memory, flash read-only memory, programmable read-only memory, electrically erasable programmable memory, and registers. The storage medium is located in the memory, and the processor reads the information in the memory and executes the steps in the above method in conjunction with the hardware. For the sake of brevity of the specification, it will not be described in detail here.

[0281] The embodiment of the present application also provides a system, the system includes a first site edge and a second site edge, the first site edge can be the above-mentioned secure message transmission device 600 or network device 800, the second site edge can be the above-mentioned secure message transmission device 700 or network device 800, the first site edge can be used to implement the above Figure 2 or Figure 5 In the method embodiment described above, the second site edge can be used to implement the above Figure 2 or Fig. 9 The method embodiments described herein can be specifically referred to above. Figure 2 or Figure 5 or Fig. 9 The description of the method embodiment will not be repeated here.

[0282] The present application also provides a computer storage medium including program instructions. When the program instructions are executed on a processor, the processor implements the above Figure 2 or Figure 5 or Fig. 9 Each step in the method embodiment is described.

[0283] The present application also provides a computer program product including program instructions. When the program instructions are executed on a processor, the processor implements the above Figure 2 or Figure 5 or Fig. 9 Each step in the method embodiment is described.

[0284] Those of ordinary skill in the art will appreciate that the various method steps and units described in the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0285] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0286] In several embodiments provided in the present application, the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0287] The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0288] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0289] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0290] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. When the computer program instructions are loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (for example, a digital video disc (digitalvideo disc, DVD), or a semiconductor medium (such as a solid state drive), etc.

[0291] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for securely transmitting a message, characterized in that: The method comprises: The first site egress device edge in the wide area network receives the virtual private network VPN service message in the virtual routing forwarding VRF; The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message; The first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound endpoint of the overlay end-to-end tunnel, the second site edge is an outbound endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP; The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.

2. The method according to claim 1, characterized in that The security protection of the VPN service message includes: Encrypting the VPN service message using the Encapsulation Security Payload (ESP) protocol; and / or, The VPN service message is encapsulated with an Authentication Header.

3. The method according to claim 1 or 2, characterized in that: The tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

4. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

5. The method according to claim 4, characterized in that The first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy between the first POP and the second POP according to the next hop SID of the END.SID.

6. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

7. The method according to claim 6, characterized in that The first information is a first node SID of the first POP, and the operations associated with the first node SID include: An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

8. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

9. The method according to claim 3, characterized in that: The overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

10. The method according to any one of claims 1 to 9, characterized in that: Before the first site edge receives the service message, the method further includes: The first site edge receives a Border Gateway Protocol (BGP) route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

11. The method according to claim 10, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP S-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

12. The method according to claim 10 or 11, characterized in that: The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

13. The method according to any one of claims 10 to 12, characterized in that: The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

14. The method according to any one of claims 10 to 13, characterized in that: The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel EncapsulationAttribute TLV includes the IPsec SA.

15. The method according to any one of claims 10 to 14, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

16. The method according to any one of claims 10 to 15, characterized in that: The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

17. A method for securely transmitting a message, characterized in that: The method comprises: A second site egress device edge in a wide area network receives a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance (IPsec) SA negotiated by the second site edge and the first site edge; the second site edge decapsulates the second message to obtain a first message; The second site edge processes the first message according to the IPsecSA to obtain the VPN service message.

18. The method according to claim 17, characterized in that The processing of the first message includes: According to the IPsecSA, decrypting the first message by the Encapsulating Security Payload (ESP) protocol; and / or, The first message is authenticated according to the IPsec SA and the authentication data carried in the Authentication Header of the first message.

19. The method according to claim 17 or 18, characterized in that The tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

20. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

21. The method according to claim 20, characterized in that The first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy between the first POP and the second POP according to the next hop SID of the END.SID.

22. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLSTE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

23. The method according to claim 22, characterized in that The first information is a first node SID of the first POP, and the operations associated with the first node SID include: An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

24. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

25. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

26. The method according to any one of claims 17 to 25, characterized in that Before the second site egress device edge in the wide area network receives the second message sent by the first site edge through the upper layer overlay end-to-end tunnel, the method further includes: The second site egress device edge generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual route forwarding VRF matching the Export RT; The second site edge announces the BGP route to the first site edge.

27. The method according to claim 26, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP S-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

28. The method according to claim 26 or 27, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

29. The method according to any one of claims 26 to 28, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

30. The method according to any one of claims 26 to 29, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel EncapsulationAttribute TLV includes the IPsec SA.

31. The method according to any one of claims 26 to 30, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

32. The method according to any one of claims 26 to 31, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

33. A method for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The method comprises: The first site egress device edge in the wide area network receives a border gateway protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT; According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

34. The method according to claim 33, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP S-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

35. The method according to claim 33 or 34, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

36. The method according to any one of claims 33 to 35, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

37. The method according to any one of claims 33 to 36, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel EncapsulationAttribute TLV includes the IPsec SA.

38. The method according to any one of claims 33 to 37, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

39. The method according to any one of claims 33 to 38, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

40. A method for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The method comprises: The second site egress device edge in the wide area network generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT; The second site edge announces the BGP route to the first site edge.

41. The method according to claim 40, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP S-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

42. The method according to claim 40 or 41, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

43. The method according to any one of claims 40 to 42, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

44. The method according to any one of claims 40 to 43, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel EncapsulationAttribute TLV includes the IPsec SA.

45. The method according to any one of claims 40 to 44, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

46. ​​The method according to any one of claims 40 to 45, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

47. A device for securely transmitting messages, characterized in that: The apparatus comprises a module for implementing the method according to any one of claims 1-16.

48. A device for securely transmitting messages, characterized in that: The apparatus comprises a module for implementing the method according to any one of claims 17-32.

49. A device for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The apparatus comprises a module for implementing the method as claimed in any one of claims 33-39.

50. A device for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The apparatus comprises a module for implementing the method as claimed in any one of claims 40-46.

51. A network device, characterized in that: It includes a memory and a processor, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method as described in any one of claims 1 to 16, or to implement the method as described in any one of claims 17 to 32, or to implement the method as described in any one of claims 33 to 39, or to implement the method as described in any one of claims 40 to 46.

52. A system, characterized in that: It includes a first site export device edge and a second site edge, the first site edge is used to execute the method as described in any one of claims 1 to 16, and the second site edge is used to execute the method as described in any one of claims 17 to 32; or, the first site edge is used to execute the method as described in any one of claims 33 to 39, and the second site edge is used to execute the method as described in any one of claims 40 to 46.

53. A computer storage medium, characterized in that Comprising program instructions, which, when executed on a processor, enable the processor to implement the method as described in any one of claims 1 to 16, or enable the processor to implement the method as described in any one of claims 17 to 32, or enable the processor to implement the method as described in any one of claims 33 to 39, or enable the processor to implement the method as described in any one of claims 40 to 46.

54. A computer program product comprising program instructions, characterized in that When the program instructions are executed on a processor, the processor implements the method as described in any one of claims 1 to 16, or the processor implements the method as described in any one of claims 17 to 32, or the processor implements the method as described in any one of claims 33 to 39, or the processor implements the method as described in any one of claims 40 to 46.

Images