Service chain SFC authentication method and device, communication equipment, medium and product

Abstract

The invention relates to a service chain SFC authentication method and device, communication equipment, a medium and a product. The method comprises the following steps: in response to a network access request of a target user, sending an access authentication request to an AAA server, and receiving user information corresponding to the target user and SFC service attribute information issued by the AAA server; under the condition that the target user has the SFC service use permission, establishing a user table corresponding to the target user locally based on the user information and the SFC service attribute information, and sending SFC service configuration information to a forwarding plane of the virtual broadband access gateway so as to store an SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used for forwarding the SFC service flow of the target user arriving at the forwarding plane. According to the method provided by the invention, the blank of SFC service authentication in a forwarding and control separation scene can be filled.

Description

Technical Field

[0001] This application relates to the field of data communication technology, and in particular to an authentication method, apparatus, communication device, storage medium, and computer program product for a Service Chain Authentication (SFC). Background Technology

[0002] Control-transfer separation vBNG is a hot topic in metropolitan area network (MAN) cloud deployments. Control-transfer separation vBNG includes separately deployed control plane network elements vBNG-CP (virtualized control plane, also known as the control plane) and forwarding plane network elements vBNG-UP (virtualized forwarding plane, also known as the forwarding plane). The control plane is responsible for user access and management; the forwarding plane and control plane communicate through the CU (Control-User Channel) for management, control, and information reporting.

[0003] For the control separation scenario, only the interaction related to vBNG-CP and vBNG-pUP is involved, but this interaction method cannot be directly applied to SFC services.

[0004] There are gaps in the relevant technologies regarding authentication methods for SFC (Service Function Chain) business in scenarios involving the separation of control and transfer. Summary of the Invention

[0005] This application provides an authentication method, apparatus, communication device, storage medium, and computer program product for Service Chain Functions (SFC), which can fill the gap in SFC business authentication in the context of control separation.

[0006] Firstly, this application provides an authentication method for Service Chain Authentication (SFC), applied to the control plane of a virtual broadband access gateway, the method comprising:

[0007] In response to a network access request from a target user, an access authentication request is sent to the AAA server, and user information and SFC service attribute information corresponding to the target user are received from the AAA server. The user information includes SFC service authentication information, which indicates whether the target user has the right to use the SFC service. The SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0008] If the target user has SFC service access rights, a user table corresponding to the target user is established locally based on user information and SFC service attribute information, and the SFC service configuration information is sent to the forwarding plane of the virtual broadband access gateway to save the SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used to forward the SFC service traffic of the target user that arrives at the forwarding plane.

[0009] In one embodiment, the user information and SFC service attribute information corresponding to the target user sent by the AAA server are received, including:

[0010] When the target user is authenticated by username and / or password, the system receives the user information and SFC business attribute information corresponding to the target user from the AAA server.

[0011] In one embodiment, the SFC service attribute information includes one or more of the following:

[0012] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0013] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0014] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0015] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0016] In one embodiment, after receiving the user information and SFC service attribute information corresponding to the target user sent by the AAA server, the method further includes:

[0017] Obtain the SFC template corresponding to the SFC template name. At least one TE path is bound within the SFC template. Each TE path covers the SF node where all services in the SFC template are located, ensuring that when SFC service traffic is transmitted along each TE path, it passes through the SF node in sequence and executes the corresponding service.

[0018] Based on the SFC template, and at least one of the following: SFC service priority, SFC service tunnel type, and SFC service tunnel name, generate the SFC service configuration information for the target user.

[0019] In one embodiment, obtaining the SFC template corresponding to the SFC template name includes:

[0020] If the SFC service authentication information indicates that the target user has an authorization to use SFC services, the corresponding SFC template is searched locally in the control plane according to the SFC template name.

[0021] If the corresponding SFC template is not found locally on the control plane, request the SFC template corresponding to the SFC template name from the OSS / BSS system.

[0022] Secondly, this application provides an authentication method for Service Chain Authentication (SFC), applied to the forwarding plane of a virtual broadband access gateway, the method comprising:

[0023] Receive SFC service configuration information sent by the control plane of the virtual broadband access gateway; wherein, the SFC service configuration information is generated by the control plane in response to the network access request of the target user, sending an access authentication request to the AAA server, and receiving the user information and SFC service attribute information corresponding to the target user issued by the AAA server, and generating the information based on the SFC service attribute information if the target user has the right to use the SFC service.

[0024] Based on the SFC service configuration information, generate an SFC instance corresponding to the target user and save it locally;

[0025] Receive SFC service traffic from the target user and forward the SFC service traffic according to the SFC instance.

[0026] In one embodiment, based on the SFC service configuration information, an SFC instance corresponding to the target user is generated and saved locally, including:

[0027] Based on the SFC service configuration information, obtain the SFC instance;

[0028] For each TE path in the SFC instance, network reachability checks are performed on all SF nodes in the path to obtain the check results for each TE path. Based on the check results of each TE path, a status label is applied to each TE path.

[0029] Create a target storage space and save the SFC instance and the status marking results of each TE path to the target storage space.

[0030] In one embodiment, based on the inspection results of each TE path, a status label is applied to each TE path to obtain the status label results for all TE paths, including:

[0031] If the inspection result of an SF node in the TE path fails, the TE path will be marked as the first marked result.

[0032] If the inspection result of the TE path does not contain an SF node, it fails the characterization test. Then the TE path is marked as the second marked result.

[0033] In one embodiment, the SFC service attribute information includes one or more of the following:

[0034] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0035] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0036] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0037] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0038] In one embodiment, when the SFC instance includes SFC service priority, SFC service tunnel name, and SFC service tunnel type, receiving the SFC service traffic of the target user and forwarding the SFC service traffic according to the SFC instance includes:

[0039] Receive SFC service traffic sent by the target user;

[0040] Analyze the traffic characteristic information of SFC service traffic to obtain the traffic type of SFC service traffic;

[0041] Match SFC instances and traffic types to determine at least one matching TE path for SFC service traffic;

[0042] Based on the status marking results of all matching TE paths and the SFC service priority, the target TE path is determined from at least one matching TE path, and the target SFC service tunnel is confirmed based on the SFC service tunnel name and SFC service tunnel type bound to the target TE path; wherein, the status marking results of the TE path represent reachability.

[0043] SFC service traffic is carried through the target SFC service tunnel and traffic is forwarded according to the target TE path.

[0044] Thirdly, this application provides an authentication method for a Service Chain Authentication Center (SFC), the method comprising:

[0045] In response to a target user's network access request, the virtual broadband access gateway sends an access authentication request to the AAA server and receives user information and SFC service attribute information corresponding to the target user from the AAA server. The user information includes SFC service authentication information; the SFC authentication information indicates whether the target user has the right to use the SFC service; and the SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0046] When the target user has the right to use SFC services, the control plane establishes a user table corresponding to the target user locally based on the user information and SFC service attribute information, and sends the SFC service configuration information to the forwarding plane of the virtual broadband access gateway.

[0047] The forwarding plane generates an SFC instance corresponding to the target user based on the SFC service configuration information and saves it locally;

[0048] The forwarding plane receives the SFC service traffic from the target user and forwards the SFC service traffic according to the SFC instance.

[0049] Fourthly, this application provides an authentication device for a Service Chain Authentication (SFC) applied to the control plane of a virtual broadband access gateway. The device includes:

[0050] The access response module is used to respond to the network access request of the target user, send an access authentication request to the AAA server, and receive the user information and SFC service attribute information corresponding to the target user issued by the AAA server. Among them, the user information includes SFC service authentication information; the SFC service authentication information indicates whether the target user has the right to use SFC services; the SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0051] The processing module is used to establish a user table corresponding to the target user locally based on user information and SFC service attribute information when the target user has SFC service access rights, and send the SFC service configuration information to the forwarding plane of the virtual broadband access gateway so as to save the SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used to forward the SFC service traffic of the target user that arrives at the forwarding plane.

[0052] Fifthly, this application provides an authentication device for a Service Chain Authentication (SFC) applied to the forwarding plane of a virtual broadband access gateway. The device includes:

[0053] The receiving module is used to receive SFC service configuration information sent by the control plane of the virtual broadband access gateway. The SFC service configuration information is generated by the control plane in response to the network access request of the target user, sending an access authentication request to the AAA server, and receiving the user information and SFC service attribute information corresponding to the target user issued by the AAA server. If the target user has the right to use SFC services, the SFC service configuration information is generated based on the SFC service attribute information.

[0054] The save module is used to generate an SFC instance corresponding to the target user based on the SFC service configuration information and save it locally.

[0055] The forwarding control module is used to receive SFC service traffic from target users and forward the SFC service traffic according to the SFC instance.

[0056] Sixthly, this application provides an authentication device for a Service Chain Authentication (SFC), the device comprising:

[0057] The access response module is used to, when the control plane of the virtual broadband access gateway receives a network access request from a target user, send an access authentication request to the AAA server and receive user information and SFC service attribute information corresponding to the target user from the AAA server; wherein, the user information includes SFC service authentication information; the SFC authentication information indicates whether the target user has the right to use the SFC service; the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user;

[0058] The processing module is used by the control plane to establish a user table corresponding to the target user locally based on user information and SFC service attribute information when the target user has SFC service access rights, and to send the SFC service configuration information to the forwarding plane of the virtual broadband access gateway.

[0059] The generation module is used by the forwarding plane to generate an SFC instance corresponding to the target user based on the SFC service configuration information and save it locally.

[0060] The forwarding control module is used to receive SFC service traffic from target users and forward the SFC service traffic according to the SFC instance.

[0061] In a seventh aspect, this application also provides a communication device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0062] Eighthly, this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described above.

[0063] Ninthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0064] The aforementioned service chain SFC authentication method, apparatus, communication equipment, storage medium, and computer program product, respond to the network access request of the target user through the control plane applied to the virtual broadband access gateway. It sends an access authentication request to the AAA server and receives user information and SFC service attribute information corresponding to the target user from the AAA server. The user information includes SFC service authentication information; the SFC service authentication information indicates whether the target user has SFC service access rights; the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user; if the target user has SFC service access rights, a user table corresponding to the target user is established locally on the control plane based on the user information and SFC service attribute information, and the SFC service configuration information is sent to the forwarding plane of the virtual broadband access gateway to store the SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used to forward the SFC service traffic of the target user arriving at the forwarding plane. SFC service permission authentication is completed through interaction between the control plane and the AAA server. Forwarding SFC configuration information is generated for users with usage permissions, avoiding the occupation of forwarding plane resources by SFC traffic from unauthorized users and improving forwarding accuracy. The SFC instance is equivalent to a customized forwarding template. After receiving user traffic, the forwarding plane can directly call the locally stored SFC instance to complete the orderly service chain linkage and path forwarding, ensuring the consistency of service chain execution. When the user's SFC service attributes change or the network status is adjusted, the control plane can update the configuration through interaction with the AAA server and synchronize it to the forwarding plane, realizing dynamic iteration of SFC instances and ensuring that the forwarding strategy of the forwarding plane always adapts to the service and network status. The forwarding plane matches locally stored SFC instances with user identifiers and service types, avoiding complex queries during traffic forwarding, reducing forwarding latency, and adapting to real-time business needs. Through collaboration between the control plane, AAA server, and forwarding plane, the entire process of SFC service permission verification, requirement parsing, and forwarding execution is standardized and made more efficient. Ultimately, it achieves accurate identification, rule-based forwarding, dynamic adaptation, and improved collaboration efficiency for target user SFC service traffic, solving the issues of legality, consistency, and efficiency in SFC service traffic forwarding under the control-forwarding separation scenario. Attached Figure Description

[0065] Figure 1 This is a schematic diagram illustrating an application scenario of the authentication method for the Service Chain FC in one embodiment.

[0066] Figure 2 This is an authentication method for the Service Chain Function (SFC) of the control plane of a virtual broadband access gateway, as described in one embodiment.

[0067] Figure 3 This is an authentication method for the Service Chain (SFC) of the forwarding plane of a virtual broadband access gateway, as described in one embodiment.

[0068] Figure 4 This is a schematic diagram illustrating the process of the forwarding plane forwarding SFC service traffic based on an SFC instance in one embodiment;

[0069] Figure 5 This is a flowchart illustrating an authentication method for a Service Chain Authentication (SFC) in one embodiment.

[0070] Figure 6 This is a flowchart illustrating another authentication method for a Service Chain FC in one embodiment;

[0071] Figure 7 This is a structural block diagram of an authentication device for the Service Chain (SFC) of the control plane applied to a virtual broadband access gateway in one embodiment.

[0072] Figure 8 This is a structural block diagram of an authentication device for a Service Chain (SFC) on the forwarding plane of a virtual broadband access gateway, as described in one embodiment.

[0073] Figure 9 This is a structural block diagram of the authentication device of the Service Chain SFC in one embodiment;

[0074] Figure 10 This is an internal structural diagram of a communication device in one embodiment. Detailed Implementation

[0075] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0076] Figure 1 This is a schematic diagram illustrating an application scenario for service chain SFC authentication provided in an embodiment of this application. For example... Figure 1As shown, the scenario includes terminal 101, control plane 102 of virtual broadband access gateway, AAA server 103 and forwarding plane 104 of virtual broadband access gateway, and SF node 105. In response to a network access request sent by a target user through terminal 101, the control plane 102 of the virtual broadband access gateway sends an access authentication request to the AAA server 103 and receives user information and SFC service attribute information corresponding to the target user from the AAA server 103. The user information includes SFC service authentication information, which indicates whether the target user has SFC service access rights. The SFC service attribute information is used to generate SFC service configuration information corresponding to the target user. If the target user has SFC service access rights, the control plane 102 establishes a user table corresponding to the target user locally based on the user information and SFC service attribute information, and sends the SFC service configuration information to the forwarding plane 104 of the virtual broadband access gateway. The forwarding plane 104 generates an SFC instance corresponding to the target user based on the SFC service configuration information and saves it locally. The forwarding plane 104 receives the target user's SFC service traffic and forwards the SFC service traffic according to the SFC instance. Specifically, the forwarding plane 104 forwards the SFC service traffic to the SF node 105 according to the SFC instance.

[0077] In addition, it may include OSS / BSS system 106. Correspondingly, control plane 102 can also interact with OSS / BSS system 106. Specifically, control plane 102 can request SFC template corresponding to SFC template name from OSS / BSS system 106, and then obtain SFC service configuration information based on SFC template.

[0078] Terminal 101 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. SF nodes can, but are not limited to, providing network equipment such as firewalls, load balancers, SRv6-supporting routers, and security detection services.

[0079] It should be noted that the beneficial effects or technical problems solved by the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0080] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0081] Among them, the control plane (CP) and forwarding plane (UP) functions of the vBNG are deployed separately, and the two do not need to be deployed in the same physical entity.

[0082] In one embodiment, such as Figure 2 As shown, an authentication method for the Service Chain (SFC) of the control plane of a virtual broadband access gateway is provided. This method is applied to... Figure 1 The following steps are used as an example to illustrate the control plane 103 of the virtual broadband access gateway:

[0083] Step 201: In response to the network access request of the target user, send an access authentication request to the AAA server and receive the user information and SFC service attribute information corresponding to the target user issued by the AAA server; wherein, the user information includes SFC service authentication information; the SFC service authentication information indicates whether the target user has the right to use the SFC service; the SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0084] SFC, also known as SRv6 SFC (Segment Routing over IPv6 Service Function Chain), is a technology that guides packets through application layer service devices sequentially along a specified path by adding SRv6 path information to the original packets.

[0085] An AAA server is a core component of network access control, a dedicated server that implements the three main functions of authentication, authorization, and accounting to regulate user access to network resources. Meanwhile, a RADIUS server is a server device based on the RADIUS protocol (Remote Authentication Dial-Up User Service), and is one of the mainstream technical solutions for implementing AAA functions. An AAA server implemented based on the RADIUS protocol can be called a RADIUS server or a RADIUS AAA server.

[0086] SFC service attribute information is used to describe parameters for network traffic forwarding, and may include: SFC template name, SFC service priority, SFC service tunnel type, SFC service tunnel name, etc.

[0087] SFC service authentication information can be expressed through preset flags to distinguish whether a user is authorized to use SFC services. Specifically, if the returned result indicates that the user is authorized to use SFC services, the corresponding SFC service template is searched locally based on the SFC service attributes; if the corresponding SFC service template cannot be found locally, the user's SFC service template is requested from the OSS (Operations Support System) / BSS (Business Support System).

[0088] vBNG (virtual Broadband Network Gateway): A network access control layer virtualization solution based on BRAS (Broadband Remote Access Server) functionality.

[0089] The target users can be personal user terminal devices, home broadband devices, enterprise leased line service access devices, and Internet of Things devices (specifically, smart cameras and sensors).

[0090] The network access request includes the target user's information, which is used to verify the target user's identity. This information includes the username and corresponding password. The user terminal can send the network access request via PPPoE (Point-to-Point Protocol over Ethernet) / IPoE (IP over Ethernet), or via a terminal (computer, mobile phone, server) accessing the network (wired, WiFi (Wireless Fidelity), 5G (5th Generation Mobile Communication Technology)).

[0091] For example, when the target user is an individual user, the individual user accesses the network through a terminal, controls the sending of a network access request containing the username and corresponding password to the AAA server, so as to authenticate, authorize and account for the user information, and receive the user information and SFC service attribute information corresponding to the target user issued by the AAA server.

[0092] Step 202: If the target user has SFC service access rights, a user table corresponding to the target user is established locally based on user information and SFC service attribute information, and the SFC service configuration information is sent to the forwarding plane of the virtual broadband access gateway to save the SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used to forward the SFC service traffic of the target user that arrives at the forwarding plane.

[0093] Among them, SFC business attributes are key configuration information issued by the AAA server, which may include SFC template name, business priority, tunnel type, etc. Its core function is to provide personalized parameters for the instantiation of SFC templates, clarify the template identifier and exclusive configuration corresponding to the current user, and act as a bridge connecting user permissions and specific templates.

[0094] An SFC template is a standardized set of pre-configured settings on the device, internally bound to a specific TE path (i.e., the order in which traffic must pass through SF nodes, also known as an SR TE (Segment Routing Traffic Engineering Policy) path or SFC path). It is essentially a configuration template framework; it is not directly associated with a user. It requires the SFC service attributes to pass in the corresponding template name before determining which user and with what parameters the SFC service configuration information will be generated.

[0095] An SFC instance is a dedicated runtime entity created by the UP (control plane) for a specific user, based on personalized parameters in the SFC service configuration information (such as SFC service priority and tunnel information (e.g., SFC service tunnel type and SFC service tunnel name)). It is stored in the UP's dedicated memory space and is directly used to handle the user's SFC traffic forwarding, serving as the actual execution carrier of the SFC service on the forwarding plane.

[0096] For example, when the target user has SFC service access rights, the control plane of the virtual broadband access gateway associates user information and SFC service attribute information, and establishes a user table corresponding to the target user locally to store user information and SFC service attribute information. It also sends SFC service configuration information to the forwarding plane of the virtual broadband access gateway so that the forwarding plane can obtain the SFC instance corresponding to the target user through the SFC service configuration information and save the SFC instance. When the forwarding plane obtains SFC service traffic, it forwards the SFC service traffic of the target user to the forwarding plane according to the SFC instance.

[0097] In the aforementioned authentication method for Service Chain Authentication (SFC) on the control plane of a virtual broadband access gateway, in response to a target user's network access request, an access authentication request is sent to the AAA server, and the target user's corresponding user information and SFC service attribute information are received from the AAA server. The user information includes SFC service authentication information, which indicates whether the target user has SFC service access rights. The SFC service attribute information is used to generate SFC service configuration information corresponding to the target user. If the target user has SFC service access rights, a user table corresponding to the target user is established locally based on the user information and SFC service attribute information, and the SFC service configuration information is sent to the forwarding plane of the virtual broadband access gateway to store the target user's corresponding SFC instance in the forwarding plane. The SFC instance is used to forward the target user's SFC service traffic arriving at the forwarding plane. SFC service permission authentication is completed through an AAA server, generating forwarding configurations only for users with authorized access. This prevents unauthorized users' SFC traffic from consuming forwarding plane resources, reducing ineffective forwarding overhead, and clearly defining the scope of forwarding targets to improve forwarding accuracy. The SFC instance acts as a "customized forwarding template." After receiving user traffic, the forwarding plane can directly invoke the instance to complete ordered service chain linkage and path forwarding, ensuring consistency in service chain execution. When user service attributes change or network conditions adjust, the control plane can quickly update the configuration and synchronize it to the forwarding plane, enabling dynamic iteration of the SFC instance and ensuring that the forwarding strategy always adapts to service and network conditions. After receiving the configuration, the forwarding plane can quickly match the SFC instance using the user identifier, avoiding complex queries during traffic forwarding, reducing forwarding latency, and adapting to real-time service requirements.

[0098] In one embodiment, receiving user information and SFC service attribute information corresponding to the target user sent by the AAA server includes:

[0099] When the target user is authenticated by username and / or password, the system receives the user information and SFC business attribute information corresponding to the target user from the AAA server.

[0100] Specifically, if the target user can successfully authenticate using their username and / or password, the AAA server pre-configures a list of users with activated SFC service. The AAA server then compares this list with the user information to confirm whether the target user has SFC service access. If the target user has SFC service access, it means they have activated the SFC service. If the target user can successfully authenticate using their username and / or password but does not have SFC service access, it means they have not activated the SFC service. If the target user cannot successfully authenticate using their username and / or password, it means they have not activated the SFC service.

[0101] For example, if the AAA server compares the list of users who have activated the SFC service with their user information and confirms that the target user has the right to use the SFC service, the AAA server sends the target user's corresponding user information and SFC service attribute information to the control plane for the control plane to receive. Optionally, if it is confirmed that the target user does not have the right to use the SFC service, the AAA server will not send the target user's corresponding user information and SFC service attribute information to the control plane.

[0102] In one embodiment, the SFC business attribute information includes one or more of the following:

[0103] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0104] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0105] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0106] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0107] The SFC template name is obtained as follows: A new SFC module is added locally on the control plane. The SFC module is configured with the SFC template name (e.g., User1-SFC-path1) and template content, such as SFC service tunnel type, SFC service priority, SFC service tunnel type, and SFC service tunnel name. At least one TE path is bound to the SFC template (the TE path can be automatically generated or manually generated. Automatic generation means directly installing the TE path issued by the upper-layer controller; manual generation means the network administrator manually specifies the segment list leading to a specific SF). The SFC template name is configured in the user authentication template of the RADIUS server. User-related attribute information issued from the RADIUS server to the control plane can carry the SFC template name.

[0108] SFC Service Priority: Prioritizes and schedules traffic on the TE paths of target users. When a user has multiple SFC service templates (multiple TE paths), traffic on the highest priority TE path is forwarded first.

[0109] SFC Service Tunnel Type: Indicates the type of actual service and the tunnel encapsulation type. SFC service types can be based on Layer 2 VPN (Virtual Private Network) / Layer 3 VPN / Layer 2 EVPN (Ethernet Virtual Private Network) / Layer 3 EVPN. The forwarding plane bearer technology can be SRv6 (Segment Routing IPv6, segment routing based on the IPv6 (Internet Protocol Version 6) forwarding plane) encapsulation or MPLS (Multi-Protocol Label Switching) encapsulation.

[0110] SFC Service Tunnel Name: Indicates the TE tunnel name applied in the SFC service template (TE tunnels require additional configuration on the control plane and / or forwarding plane devices; the SFC service tunnel name must match the TE tunnel configured on the control plane and / or forwarding plane devices to be successfully applied). All traffic matching the SFC service enters the SFC service tunnel.

[0111] In one embodiment, after receiving the user information and SFC service attribute information corresponding to the target user sent by the AAA server, the method further includes:

[0112] Obtain the SFC template corresponding to the SFC template name. At least one TE path is bound within the SFC template. Each TE path covers the SF node where all services in the SFC template are located, ensuring that when SFC service traffic is transmitted along each TE path, it passes through the SF node in sequence and executes the corresponding service.

[0113] Based on the SFC template, and at least one of the following: SFC service priority, SFC service tunnel type, and SFC service tunnel name, generate the SFC service configuration information for the target user.

[0114] Among them, SF (Service Function): SF unit (i.e. SF node) is a functional node that provides network services. It can be a virtual network element, a physical network element, or a part of the functional unit embedded in a physical network element. SF unit processes the received packets and can provide network functions such as virtual firewall, load balancer, TCP (Transmission Control Protocol) optimizer.

[0115] For example, when the control plane receives the user information and SFC service attribute information corresponding to the target user from the AAA server, it can obtain the corresponding SFC template from the local machine according to the SFC template name in the SFC service attribute, and each template is bound to at least one TE path. Then, based on the SFC template and the SFC service priority, SFC service tunnel type and SFC service tunnel in the SFC service attribute, the service configuration information of the target user is generated.

[0116] In one embodiment, obtaining the SFC template corresponding to the SFC template name includes:

[0117] If the SFC service authentication information indicates that the target user has an authorization to use SFC services, the corresponding SFC template is searched locally in the control plane according to the SFC template name.

[0118] If the corresponding SFC template is not found locally on the control plane, request the SFC template corresponding to the SFC template name from the OSS / BSS system.

[0119] Among them, OSS / BSS is the core support system of network operators. OSS (Operations Support System) manages "network operation and maintenance", and BSS (Business Support System) manages "customers and revenue". The two work together to support the entire process from service activation to network operation and maintenance.

[0120] For example, if the returned result indicates that the user has authorization for SFC services, the corresponding SFC service template is first searched locally in the control plane; if the corresponding SFC template is not found locally in the control plane, a request is made to the OSS / BSS system to obtain the user's SFC service template, until the SFC service template is obtained. In one embodiment, the TE path is obtained in the following way: the TE path can be automatically generated or manually generated. Automatic generation means directly installing the TE path issued by the upper-layer controller, while manual generation means that the network administrator manually specifies the segment list to a specific SF.

[0121] In one embodiment, such as Figure 3 As shown, an authentication method for the Service Chain Authentication (SFC) of the forwarding plane of a virtual broadband access gateway is provided. This method is applied to... Figure 1 Taking the forwarding plane 104 of the virtual broadband access gateway as an example, the following steps are included:

[0122] Step 301: Receive SFC service configuration information sent by the control plane of the virtual broadband access gateway; wherein, the SFC service configuration information is generated by the control plane in response to the network access request of the target user, sending an access authentication request to the AAA server, and receiving the user information and SFC service attribute information corresponding to the target user issued by the AAA server, and based on the SFC service attribute information if the target user has the right to use SFC services.

[0123] For example, when a target user sends a network access request via PPPoE / IPoE, the control initiates a network access request containing the username and corresponding password to the AAA server to authenticate, authorize, and account for user information. It also receives the user information and SFC service attribute information corresponding to the target user from the AAA server. If the target user has SFC service access rights, it generates SFC service configuration information based on the SFC service attribute information and sends the SFC service configuration information to the forwarding plane so that the forwarding plane can receive the SFC service configuration information.

[0124] Step 302: Based on the SFC service configuration information, generate the SFC instance corresponding to the target user and save it locally.

[0125] For example, the forwarding plane obtains the SFC instance corresponding to the target user through the SFC service configuration information and saves the SFC instance in the local target space.

[0126] Step 303: Receive the SFC service traffic of the target user and forward the SFC service traffic according to the SFC instance.

[0127] For example, when the SFC service traffic of the target user is obtained, the forwarding plane first determines the corresponding SFC instance based on the target user's identifier, and then forwards the SFC service traffic of the target user to the forwarding plane based on the TE path information in the SFC instance.

[0128] The aforementioned authentication method for Service Chain Functions (SFC) on the forwarding plane of a virtual broadband access gateway can solve the problem of insufficient forwarding plane coordination capability in scenarios involving SFC services, where forwarding and control are separated.

[0129] In one embodiment, generating an SFC instance corresponding to the target user based on the SFC service configuration information and saving it locally includes:

[0130] Based on the SFC service configuration information, obtain the SFC instance;

[0131] For each TE path in the SFC instance, network reachability checks are performed on all SF nodes in the path to obtain the check results for each TE path. Based on the check results of each TE path, a status label is applied to each TE path.

[0132] Create a target storage space and save the SFC instance and the status marking results of each TE path to the target storage space.

[0133] Network reachability checking is a diagnostic method to verify whether two network nodes (i.e., two SF nodes) can communicate normally. Its core function is to locate network outages, congestion, or configuration anomalies by testing connectivity, transmission quality, and path validity. Specifically, ping can be used to verify connectivity, latency, and packet loss rate between SF nodes.

[0134] A TE path contains multiple SF nodes. When the network reachability check of all SF nodes in a TE path passes, it means that SFC service traffic can be forwarded normally through that TE path, indicating that the TE path's reachability check has passed. When the network reachability check of an SF node in a TE path fails, it means that SFC service traffic cannot be forwarded normally through that TE path, indicating that the TE path's reachability check has failed.

[0135] The status flag can be a preset flag character, only needing to differ between cases where the TE path check passes and cases where the TE path check fails. In one embodiment, the TE path is marked as 1 when the TE path check passes, and marked as 0 when the TE path check fails.

[0136] In one embodiment, the SFC instance stored in the forwarding plane can be:

[0137] User_SFC_1 (SFC instance name): Apply SFC profile

[0138] Tunnel Type SRv6 / SR TE (SFC Service Tunnel Type)

[0139] SFC tunnel Path 1 (SFC business tunnel name 1)

[0140] QoS profile be (SFC service priority is be)

[0141] Candidate path SF1——SF2

[0142] SFC tunnel Path 2 (SFC business tunnel name 1)

[0143] QoS profile ef (SFC service priority is ef)

[0144] Candidate path SF1-SF3

[0145] Based on the above SFC example, we can see that the SFC service of user User corresponds to 2 TE paths, and the priority of the 2 TE paths.

[0146] For example, the forwarding plane obtains SFC instances based on SFC service configuration information. Each SFC instance contains at least one TE path. For each TE path in the SFC instance, network reachability checks are performed on all SF nodes in the path. When the network reachability check of all SF nodes in TE path TE-A passes, TE-A is marked as 1. When the network reachability check of an SF node in a TE path TE-B fails, TE-B is marked as 0, and so on, until all TE paths are marked. Then, the forwarding plane creates local storage space and saves the target user's SFC instance and the status marking results of each TE path in the SFC instance to this storage space.

[0147] In one embodiment, based on the inspection results of each TE path, a status label is applied to each TE path to obtain the status label results for all TE paths, including:

[0148] If the inspection result of an SF node in the TE path fails, the TE path will be marked as the first marked result.

[0149] If the inspection result of the TE path does not contain an SF node, it fails the characterization test. Then the TE path is marked as the second marked result.

[0150] For example, if the inspection result of an SF node in a TE path fails, the TE path is marked as down; if the inspection result of an SF node in a TE path fails, the TE path is marked as up.

[0151] In one embodiment, the SFC service attribute information includes one or more of the following:

[0152] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0153] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0154] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0155] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0156] When an SFC instance includes SFC service priority, SFC service tunnel name, and SFC service tunnel type... Figure 4 In one embodiment, a schematic diagram of the forwarding plane forwarding SFC service traffic based on an SFC instance is provided, including:

[0157] Step 401: Receive SFC service traffic sent by the target user.

[0158] SFC service traffic refers to network traffic that is processed sequentially through specific service function nodes (SF nodes) via the Service Function Chain (SFC) and then forwarded. Its characteristics include orderly scheduling according to preset rules and loading of service functions on demand, thus adapting to differentiated service needs.

[0159] For example, when the forwarding plane can receive SFC service traffic sent by the target user and ordinary traffic sent by non-target users, the forwarding plane can determine whether there is a corresponding SFC instance based on the user information, and then perform differentiated forwarding of SFC service traffic and ordinary traffic. That is, SFC service traffic follows the process of this application, while ordinary traffic follows the general traffic forwarding process.

[0160] Step 402: parse the traffic characteristic information of SFC service traffic to obtain the traffic type of SFC service traffic.

[0161] Traffic characteristic information can refer to packet header information or other information that distinguishes different traffic types. Specifically, it can be based on two identifiers: one is the destination IP (Internet Protocol) address, where different SFC service traffic may correspond to different backend server IPs; the other is the ToS value (Type of Service field), which uses preset different ToS values ​​to mark SFC service traffic of different priorities or types.

[0162] For example, the header information of SFC service traffic can be parsed to obtain the destination IP address and ToS value of the SFC service traffic in order to distinguish different SFC service traffic.

[0163] Step 403: Match SFC instances and traffic types to determine at least one matching TE path for SFC service traffic.

[0164] For example, the information of each SFC instance is specified, which may include the source IP segment, destination port, and DSCP (Differentiated Services Code Point) tag. Then, the information of the SFC instance is matched with the source IP segment, destination port, and DSCP in the traffic type to confirm at least one matching TE path for the SFC service traffic.

[0165] Step 404: Based on the status marking results of all matching TE paths and the SFC service priority, determine the target TE path from at least one matching TE path, and confirm the target SFC service tunnel based on the SFC service tunnel name and SFC service tunnel type bound to the target TE path; wherein, the status marking results of the TE path represent reachability.

[0166] For example, a Down status indicates that the TE path is unavailable, and an Up status indicates that the TE path is available. The forwarding plane first confirms the priority of the SFC service traffic (high / medium / low), identifies the TE path that matches its priority, and then confirms the current status (UP / Down) of the matching TE path. If the matching path is in the Up state, it is confirmed as the target TE path. If the matching TE path is in the Down state, an alternative path (if any) can be selected according to a preset policy, or a traffic unreachable message can be returned. At the same time, other matching TE paths in the Up state are confirmed as target TE paths. Then, based on the SFC service tunnel name and SFC service tunnel type bound to the target TE path, the target SFC service tunnel is confirmed.

[0167] Step 405: Carry SFC service traffic through the target SFC service tunnel and forward the traffic according to the target TE path.

[0168] Among them, the SFC service tunnel is a dedicated transmission channel for SFC traffic. SRv6 SFC: The SRH (Segment Routing Header) is embedded in the IPv6 packet, and the traffic is guided to pass through the SF in sequence through the End.AS SID (Application Service Node Identifier) ​​and End SID (Forwarding Node Identifier).

[0169] For example, the target SFC service traffic is carried through the target SFC service tunnel and then forwarded sequentially to the SF nodes in the TE path according to the target TE path until it is forwarded to the last SF node in the target TE path.

[0170] In one embodiment, such as Figure 5 As shown, a service chain authentication (SFC) method is provided, including the following steps:

[0171] Step 501: In response to the network access request of the target user, the virtual broadband access gateway sends an access authentication request to the AAA server and receives user information and SFC service attribute information corresponding to the target user from the AAA server; wherein, the user information includes SFC service authentication information; the SFC authentication information indicates whether the target user has the right to use the SFC service; the SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0172] For example, when the target user is an individual user, in response to the target user's network access request, the virtual broadband access gateway sends an access authentication request to the AAA server to authenticate, authorize, and account for the user information, and receives the user information and SFC service attribute information corresponding to the target user from the AAA server.

[0173] Step 502: If the target user has SFC service access rights, the control plane establishes a user table corresponding to the target user locally based on the user information and SFC service attribute information, and sends the SFC service configuration information to the forwarding plane of the virtual broadband access gateway.

[0174] For example, when the target user has SFC service access rights, the control plane associates user information and SFC service attribute information, establishes a user table corresponding to the target user locally to store user information and SFC service attribute information, and sends the SFC service configuration information to the forwarding plane of the virtual broadband access gateway.

[0175] Step 503: The forwarding plane generates an SFC instance corresponding to the target user based on the SFC service configuration information and saves it locally.

[0176] For example, in the forwarding plane, the SFC instance corresponding to the target user is obtained through the SFC service configuration information, and the SFC instance is saved locally.

[0177] Step 504: The forwarding plane receives the SFC service traffic of the target user and forwards the SFC service traffic according to the SFC instance.

[0178] For example, when the forwarding plane obtains the SFC service traffic of the target user, the forwarding plane forwards the SFC service traffic of the target user to the forwarding plane according to the SFC instance. When the forwarding plane obtains the traffic of a general user, it forwards it in the same way as normal traffic.

[0179] The aforementioned service chain SFC authentication method standardizes and streamlines the entire process of "authorization verification, requirement parsing, and forwarding execution" of SFC services through interaction between the control plane and the forwarding plane, and through collaboration between the control plane, the AAA server, and the forwarding plane. Ultimately, it achieves "accurate identification, rule-based forwarding, dynamic adaptation, and improved collaborative efficiency" of target user SFC service traffic, resolving the issues of legality, consistency, and efficiency in SFC service traffic forwarding under a control-forwarding separation scenario.

[0180] In one embodiment, such as Figure 6 As shown, another authentication method for Service Chain FC is provided, such as... Figure 6 As shown:

[0181] One vBAG-CP can correspond to multiple vBAG-UPs. When a vBAG-CP corresponds to vBAG-UP1 and vBAG-UP2, an SFC service module is set up in the vBAG-CP, and SFC service modules are also set up in vBAG-UP1 and vBAG-UP2. The SFC service module on the vBAG-CP is responsible for interacting with the AAA server to exchange user information and obtain SFC service information. Here, SFC service information refers to the service template obtained from the operation support system, that is, the user's activation information. The SFC service module deployed on the vBAG-UP (including vBAG-UP1 and vBAG-UP2) receives SFC service configuration information from the vBAG-CP. Here, SFC service configuration information is the command line issued by the vBAG-CP to the vBAG-UP (including vBAG-UP1 and vBAG-UP2) after the SFC service template is converted into device configuration.

[0182] As shown in the diagram, it includes three SF nodes: SF1, SF2, and SF3, and one TE path: vBAG-UP1——SF1——SF2. The SFF (Service Function Forwarder) is typically attached to an SF unit. The SFF forwards data streams to the SF nodes based on the SFC header information, and forwards data streams returned from the SF nodes to the next-hop SFF.

[0183] like Figure 6The terminal authenticates itself by sending its username / password to the SFC service module on the vBAG-CP. The vBAG-CP interacts with the RADIUS server; after authentication, RADIUS sends user attributes and SFC service attributes, including the SFC template name, SFC service priority, SFC service tunnel name, and SFC service tunnel type. Upon receiving the user attributes and SFC service attributes from RADIUS, the vBAG-CP adds the SFC service attributes to the user table. The vBAG-CP then sends the service attributes to vBAG-UP (including vBAG-UP1 and vBAG-UP2), which subsequently forwards them. The SFC service module on the vBAG-UP creates memory space for the user, obtains the SFC instance information based on the service attributes, and stores the user's SFC instance information, which includes a TE path such as... Figure 6 The diagram shows vBAG-UP1 -> SF1 -> SF2. vBAG-UP1 checks the network reachability of each SF node in the TE path. When all SF nodes pass the network reachability check, the status of the SFC service path is marked as UP, indicating that traffic can be forwarded normally through this SFC service path; when the network reachability check of one or more SF nodes fails, the TE path status is down. If the reachability check of all SF nodes in vBAG-UP1 -> SF1 -> SF2 passes, when UP1 receives relevant SFC traffic, it forwards the SFC traffic in the order of vBAG-UP1 -> SF1 -> SF2. In one embodiment, UP1 can distinguish between user traffic that has activated SFC service and user traffic that has not activated SFC service based on the destination IP address / ToS value of the traffic, and then perform differentiated forwarding.

[0184] In one embodiment, such as Figure 7 As shown, a Service Chain Authentication (SFC) authentication device 700 is provided, applied to the control plane of a virtual broadband access gateway, including: an access response module 701 and a processing module 702, wherein:

[0185] The access response module 701 is used to respond to the network access request of the target user, send an access authentication request to the AAA server, and receive user information and SFC service attribute information corresponding to the target user issued by the AAA server; wherein, the user information includes SFC service authentication information; the SFC service authentication information indicates whether the target user has the right to use SFC services; the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user.

[0186] The processing module 702 is used to establish a user table corresponding to the target user locally based on user information and SFC service attribute information when the target user has SFC service access rights, and send the SFC service configuration information to the forwarding surface of the virtual broadband access gateway so as to save the SFC instance corresponding to the target user in the forwarding surface; the SFC instance is used to forward the SFC service traffic of the target user that arrives at the forwarding surface.

[0187] In one exemplary embodiment, the processing module 702 is further configured to:

[0188] When the target user can be authenticated by username and / or password, the system receives user information and SFC business attribute information corresponding to the target user from the AAA server.

[0189] In one exemplary embodiment, the processing module 702 is further configured to:

[0190] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0191] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0192] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0193] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0194] In one exemplary embodiment, the storage module 702 is further configured to:

[0195] Obtain the SFC template corresponding to the SFC template name. At least one TE path is bound within the SFC template. Each TE path covers the SF node where all services in the SFC template are located, ensuring that when SFC service traffic is transmitted along each TE path, it passes through the SF node in sequence and executes the corresponding service.

[0196] Based on the SFC template, and at least one of the following: SFC service priority, SFC service tunnel type, and SFC service tunnel name, generate the SFC service configuration information for the target user.

[0197] In one exemplary embodiment, the processing module 702 is further configured to:

[0198] If the SFC service authentication information indicates that the target user has an authorization to use SFC services, the corresponding SFC template is searched locally in the control plane according to the SFC template name.

[0199] If the corresponding SFC template is not found locally on the control plane, request the SFC template corresponding to the SFC template name from the OSS / BSS system.

[0200] In one embodiment, such as Figure 8 As shown, an authentication device 800 for Service Chain Functions (SFC) is provided, applied to the forwarding plane of a virtual broadband access gateway, including: a receiving module 801, a storage module 802, and a forwarding control module 803, wherein:

[0201] The receiving module 801 is used to receive SFC service configuration information sent by the control plane of the virtual broadband access gateway; wherein, the SFC service configuration information is generated by the control plane in response to the network access request of the target user, sending an access authentication request to the AAA server, and receiving the user information and SFC service attribute information corresponding to the target user issued by the AAA server, and generating the information based on the SFC service attribute information if the target user has the right to use the SFC service.

[0202] The storage module 802 is used to generate an SFC instance corresponding to the target user based on the SFC service configuration information and save it locally.

[0203] The forwarding control module 803 is used to receive the SFC service traffic of the target user and forward the SFC service traffic according to the SFC instance.

[0204] In one exemplary embodiment, the storage module 802 can also be used to:

[0205] Based on the SFC service configuration information, obtain the SFC instance;

[0206] For each TE path in the SFC instance, network reachability checks are performed on all SF nodes in the path to obtain the check results for each TE path. Based on the check results of each TE path, a status label is applied to each TE path.

[0207] Create a target storage space and save the SFC instance and the status marking results of each TE path to the target storage space.

[0208] In one exemplary embodiment, the storage module 802 can also be used to:

[0209] If the inspection result of an SF node in the TE path fails, the TE path will be marked as the first marked result.

[0210] If the inspection result of the TE path does not contain an SF node, it fails the characterization test. Then the TE path is marked as the second marked result.

[0211] In one exemplary embodiment, the storage module 802 can also be used to:

[0212] The SFC template name is used to indicate the SFC template corresponding to the target user.

[0213] SFC service priority is used to indicate the priority of each TE path corresponding to the target user;

[0214] SFC service tunnel type, used to indicate the tunnel encapsulation type of SFC service;

[0215] SFC Service Tunnel Name, used to indicate the TE tunnel name applied in the SFC template.

[0216] In one exemplary embodiment, the storage module 802 can also be used to:

[0217] Receive SFC service traffic sent by the target user;

[0218] Analyze the traffic characteristic information of SFC service traffic to obtain the traffic type of SFC service traffic;

[0219] Match SFC instances and traffic types to determine at least one matching TE path for SFC service traffic;

[0220] Based on the status marking results of all matching TE paths and the SFC service priority, the target TE path is determined from at least one matching TE path, and the target SFC service tunnel is confirmed based on the SFC service tunnel name and SFC service tunnel type bound to the target TE path; wherein, the status marking results of the TE path represent reachability.

[0221] SFC service traffic is carried through the target SFC service tunnel and traffic is forwarded according to the target TE path.

[0222] In one embodiment, such as Figure 9 As shown, an authentication device 900 for Service Chain Authentication (SFC) is provided and applied to a virtual broadband access gateway. It includes: an access response module 901, a processing module 902, a generation module 903, and a forwarding control module 904, wherein:

[0223] The access response module 901 is used to respond to the network access request of the target user. The virtual broadband access gateway sends an access authentication request to the AAA server and receives user information and SFC service attribute information corresponding to the target user from the AAA server. The user information includes SFC service authentication information. The SFC authentication information indicates whether the target user has the right to use the SFC service. The SFC service attribute information is used to generate the SFC service configuration information corresponding to the target user.

[0224] Processing module 902 is used to, when the target user has the right to use SFC services, establish a user table corresponding to the target user locally based on user information and SFC service attribute information, and send the SFC service configuration information to the forwarding plane of the virtual broadband access gateway.

[0225] The generation module 903 is used to generate an SFC instance corresponding to the target user based on the SFC service configuration information and save it locally.

[0226] The forwarding control module 904 is used to receive SFC service traffic from the target user and forward the SFC service traffic according to the SFC instance.

[0227] Specific limitations regarding the authentication device of the Service Chain SFC can be found in the limitations of the authentication method of the Service Chain SFC mentioned above, and will not be repeated here. Each module in the aforementioned Service Chain SFC authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the communication device, or stored in software in the memory of the communication device, so that the processor can call and execute the corresponding operations of each module.

[0228] In one exemplary embodiment, a communication device is provided, which may be a server, and its internal structure diagram may be as follows. Figure 10 As shown, the communication device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores mobility information, a list of candidate network nodes, first / second paired master keys, and first / second matching confirmation information. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a Service Chain Authentication (SFC) method.

[0229] Those skilled in the art will understand that Figure 10The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the communication device to which the present application is applied. Specific communication devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0230] In one exemplary embodiment, a communication device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the Service Chain Authentication (SFC) method of the above-disclosed embodiments.

[0231] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the service chain SFC authentication method of the above-disclosed embodiments.

[0232] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the Service Chain Authentication (SFC) method of the above-disclosed embodiments.

[0233] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0234] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0235] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0236] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for authenticating a service chain (SFC), characterized in that, The method is applied to a control plane of a virtual broadband access gateway, and the method comprises the following steps: In response to a network access request of a target user, an access authentication request is sent to an AAA server, and user information and SFC service attribute information corresponding to the target user issued by the AAA server are received; wherein the user information comprises SFC service authentication information; the SFC service authentication information represents whether the target user has SFC service use authority; and the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user; In the case that the target user has SFC service use authority, a user table corresponding to the target user is locally established based on the user information and the SFC service attribute information, and the SFC service configuration information is sent to a forwarding plane of the virtual broadband access gateway, so as to save an SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used for forwarding SFC service traffic of the target user arriving at the forwarding plane.

2. The method of claim 1, wherein, The receiving of the user information and the SFC service attribute information corresponding to the target user issued by the AAA server comprises the following steps: In the case that the target user is authenticated by a username and / or a password, the user information and the SFC service attribute information corresponding to the target user issued by the AAA server are received.

3. The method of claim 1, wherein, The SFC service attribute information comprises one or more of the following: An SFC template name, used to indicate an SFC template corresponding to the target user; An SFC service priority, used to indicate a priority of each TE path corresponding to the target user; An SFC service tunnel type, used to indicate a tunnel encapsulation type of SFC service; An SFC service tunnel name, used to indicate a TE tunnel name applied in the SFC template.

4. The method of claim 3, wherein, After the user information and the SFC service attribute information corresponding to the target user issued by the AAA server are received, the following steps are further included: An SFC template corresponding to the SFC template name is acquired, and at least one TE path is bound in the SFC template; each TE path covers all SF nodes where services in the SFC template are located, so as to ensure that SFC service traffic is transmitted along each TE path and sequentially passes through the SF nodes and executes corresponding services; Based on the SFC template, and at least one of the SFC service priority, the SFC service tunnel type, and the SFC service tunnel name, SFC service configuration information of the target user is generated.

5. The method of claim 4, wherein, The acquiring of the SFC template corresponding to the SFC template name comprises the following steps: If the SFC service authentication information represents that the target user has SFC service use authority, a corresponding SFC template is locally searched in the control plane according to the SFC template name; If a corresponding SFC template is not found in the control plane, the SFC template corresponding to the SFC template name is requested from an OSS / BSS system.

6. An authentication method of a service chain SFC, characterized by, The method is applied to a forwarding plane of a virtual broadband access gateway, and the method comprises the following steps: receiving SFC service configuration information sent by a control plane of the virtual wideband access gateway; wherein the SFC service configuration information is generated by the control plane based on user information and SFC service attribute information corresponding to a target user and sent to a SFC instance corresponding to the target user in a case that the target user has SFC service use permission; generating the SFC instance corresponding to the target user based on the SFC service configuration information and performing local storage; receiving SFC service traffic of the target user and forwarding the SFC service traffic based on the SFC instance.

7. The method of claim 6, wherein, The generating the SFC instance corresponding to the target user based on the SFC service configuration information and performing local storage comprises: obtaining the SFC instance based on the SFC service configuration information; performing network reachability checking on all SF nodes in each TE path in the SFC instance to obtain a checking result of each TE path and marking a state of each TE path based on the checking result of each TE path; creating a target storage space and storing the SFC instance and the state marking result of each TE path in the target storage space.

8. The method of claim 7, wherein, The marking the state of each TE path based on the checking result of each TE path to obtain the state marking result of all TE paths comprises: if the checking result of the SF node in the TE path indicates not passing, marking the TE path as a first marking result; if the checking result of the SF node in the TE path indicates passing, marking the TE path as a second marking result.

9. The method of claim 6, wherein, The SFC service attribute information comprises one or more of the following: an SFC template name used for indicating an SFC template corresponding to the target user; an SFC service priority used for indicating a priority of each TE path corresponding to the target user; an SFC service tunnel type used for indicating a tunnel encapsulation type of the SFC service; an SFC service tunnel name used for indicating a TE tunnel name applied in the SFC template.

10. The method of claim 9, wherein, When the SFC instance comprises the SFC service priority, the SFC service tunnel name and the SFC service tunnel type, the receiving the SFC service traffic of the target user and forwarding the SFC service traffic based on the SFC instance comprises: receiving the SFC service traffic sent by the target user; obtaining a traffic type of the SFC service traffic by analyzing traffic characteristic information of the SFC service traffic; matching the SFC instance and the traffic type to determine at least one matching TE path for the SFC service traffic; According to the state marking result of all matched TE paths and the SFC service priority, a target TE path is determined from the at least one matched TE path, and a target SFC service tunnel is confirmed according to the SFC service tunnel name and the SFC service tunnel type bound by the target TE path, wherein the state marking result of the TE path represents reachability; The SFC service flow is carried through the target SFC service tunnel, and flow forwarding is performed according to the target TE path.

11. An authentication method of a service chain SFC, characterized in that, The method comprises: In response to a network access request of a target user, a control plane of a virtual broadband access gateway sends an access authentication request to an AAA server, and receives user information corresponding to the target user and SFC service attribute information issued by the AAA server; wherein the user information comprises SFC service authentication information; the SFC authentication information represents whether the target user has SFC service use permission; and the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user; The control plane locally establishes a user table corresponding to the target user based on the user information and the SFC service attribute information in the case that the target user has SFC service use permission, and sends the SFC service configuration information to a forwarding plane of the virtual broadband access gateway; The forwarding plane generates and locally saves an SFC instance corresponding to the target user according to the SFC service configuration information; The forwarding plane receives SFC service flow of the target user, and forwards the SFC service flow according to the SFC instance.

12. An authentication apparatus of a service chain SFC, characterized by, The control plane of the virtual broadband access gateway comprises: An access response module is configured to, in response to a network access request of a target user, send an access authentication request to an AAA server, and receive user information corresponding to the target user and SFC service attribute information issued by the AAA server; wherein the user information comprises SFC service authentication information; the SFC service authentication information represents whether the target user has SFC service use permission; and the SFC service attribute information is used to generate SFC service configuration information corresponding to the target user; A processing module is configured to, in the case that the target user has SFC service use permission, locally establish a user table corresponding to the target user based on the user information and the SFC service attribute information, and send the SFC service configuration information to a forwarding plane of the virtual broadband access gateway, so as to save an SFC instance corresponding to the target user in the forwarding plane; the SFC instance is used for forwarding SFC service flow of the target user arriving at the forwarding plane.

13. An authentication apparatus of a service chain SFC, characterized by, The forwarding plane of the virtual broadband access gateway comprises: The receiving module is configured to receive SFC service configuration information sent by a control plane of the virtual wideband access gateway; wherein, the SFC service configuration information is generated by the control plane based on user information and SFC service attribute information corresponding to a target user and sent to a forwarding plane of the virtual wideband access gateway in a case where the target user has SFC service use authority; The saving module is configured to generate and locally save an SFC instance corresponding to the target user according to the SFC service configuration information; The forwarding control module is configured to receive SFC service traffic of the target user and forward the SFC service traffic according to the SFC instance.

14. An authentication apparatus of a service chain SFC, characterized by, The application relates to a virtual wideband access gateway, and the device comprises: The access response module is configured to send an access authentication request to an AAA server and receive user information and SFC service attribute information corresponding to a target user and sent by the AAA server in a case where a control plane of the virtual wideband access gateway receives a network access request of the target user; wherein, the user information comprises SFC service authentication information; the SFC authentication information represents whether the target user has SFC service use authority; and the SFC service attribute information is used for generating SFC service configuration information corresponding to the target user; The processing module is configured to locally establish a user table corresponding to the target user based on the user information and the SFC service attribute information in a case where the target user has SFC service use authority, and send the SFC service configuration information to a forwarding plane of the virtual wideband access gateway; The generating module is configured to generate an SFC instance corresponding to the target user according to the SFC service configuration information and save the SFC instance in the forwarding plane; The forwarding control module is configured to forward SFC service traffic of the target user according to the SFC instance when the forwarding plane receives the SFC service traffic.

15. A communication device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to realize the steps of the method in any one of claims 1 to 11.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 11.

17. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 11.

Images