Two-layer data transmission method and device

Abstract

The embodiment of the invention provides a two-layer data transmission method and device, relates to the technical field of communication networks, and is suitable for various networking scenes such as an enterprise network, a data center network and an FTTR network. The method comprises the following steps: a first PE device in an L2VPN network receives a two-layer data message through an AC; matching the target message feature of the two-layer data message with a preset ACL table item; if the target message feature is successfully matched with the preset ACL table item, encrypting the two-layer data message, and adding a control word to the two-layer data message to obtain an encrypted message, the control word indicating that the message to which the control word belongs is the encrypted message; and sending the encrypted message to the second PE device in the L2VPN network through the PW. And based on the control word carried by the two-layer data message, the second PE device decrypts the two-layer data message to obtain a decrypted message and sends the decrypted message. According to the scheme, the networking cost of the L2VPN such as the FTTR can be reduced while the data transmission security in the networking of the L2VPN such as the FTTR is improved.

Description

Technical Field

[0001] This application relates to the field of communication network technology, and in particular to a two-layer data transmission method and apparatus. Background Technology

[0002] With the development of communication network technology, data transmission in networks such as enterprise networks, data center networks, and fiber-to-the-room (FTTR) networks has experienced explosive growth, and data transmission security has become an important indicator of network performance.

[0003] In current networks, Internet Protocol Security (IPsec) technology is primarily used to ensure the security of transmitted data. However, IPsec technology is used for encrypting Internet Protocol (IP) data packets in Layer 3 Virtual Private Network (L3VPN) scenarios and is not suitable for Layer 2 Virtual Private Network (L2VPN) scenarios.

[0004] To meet the data security transmission requirements in L2VPN scenarios, users need to configure an encryption device for each Customer Edge (CE) device. This encryption device encrypts the Layer 2 data sent by the CE device before transmitting it to the peer CE device. This solution has high networking costs. Summary of the Invention

[0005] The purpose of this application is to provide a Layer 2 data transmission method and apparatus to improve data transmission security in L2VPN networks while reducing networking costs. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of this application provide a Layer 2 data transmission method applied to a first service provider edge (PE) device in an L2VPN network, the method comprising:

[0007] Receive Layer 2 data packets via Attachment Circuit (AC);

[0008] The target message characteristics of the Layer 2 data packet are matched with a preset Access Control List (ACL) entry, which is used to record the message characteristics of the message to be encrypted.

[0009] If the target packet characteristics match the preset ACL entry, the target key is used to encrypt the Layer 2 data packet, and a control word is added to the Layer 2 data packet to obtain an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC.

[0010] The encrypted message is sent to the second PE device in the L2VPN network via the pseudo wire (PW).

[0011] In some embodiments, the method further includes: if the target packet characteristics fail to match the preset ACL entry, then sending the Layer 2 data packet to the second PE device in the L2VPN network through the PW.

[0012] In some embodiments, adding control words to the Layer 2 data packet includes setting a flag included in the Layer 2 data packet.

[0013] In some embodiments, the first PE device enables encryption and is configured with a first encryption attribute parameter; before receiving Layer 2 data packets via AC, the method further includes:

[0014] Receive Border Gateway Protocol (BGP) routes sent by the second PE device;

[0015] If the BGP route carries a second encryption attribute parameter, and the second encryption attribute parameter matches the first encryption attribute parameter, then the PW is established, and the target key corresponding to the PW is generated according to the second encryption attribute parameter;

[0016] If the BGP route does not carry the second encryption attribute parameter, and / or the second encryption attribute parameter does not match the first encryption attribute parameter, then the PW is established.

[0017] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the second encrypted attribute parameter; and the parameter value subfield is used to carry the second encrypted attribute parameter.

[0018] In some embodiments, the first encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0019] Secondly, embodiments of this application provide a Layer 2 data transmission method applied to a second PE device in an L2VPN network, the method comprising:

[0020] Through PW, receive public network data packets sent by the first PE device in the L2VPN network;

[0021] The public network data packets are decapsulated to obtain Layer 2 data packets;

[0022] If the Layer 2 data packet carries a control word, the Layer 2 data packet is decrypted using the target key corresponding to the PW to obtain a decrypted packet. The control word indicates that the packet is an encrypted packet.

[0023] The decryption message is sent through the AC associated with the PW.

[0024] In some embodiments, the method further includes:

[0025] If the Layer 2 data packet does not carry the control word, then the Layer 2 data packet is sent through the AC.

[0026] In some embodiments, the control word is a flag bit that has been set.

[0027] In some embodiments, the second PE device enables encryption and is configured with a second encryption attribute parameter; before receiving public network data packets sent by the first PE device in the L2VPN network via PW, the method further includes:

[0028] Receive the BGP route sent by the first PE device;

[0029] If the BGP route carries a first encryption attribute parameter, and the first encryption attribute parameter matches the second encryption attribute parameter, then the PW is established, and the target key corresponding to the PW is generated according to the first encryption attribute parameter.

[0030] If the BGP route does not carry the first encryption attribute parameter, and / or the first encryption attribute parameter does not match the second encryption attribute parameter, then the PW is established.

[0031] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the first encrypted attribute parameter; and the parameter value subfield is used to carry the first encrypted attribute parameter.

[0032] In some embodiments, the second encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0033] Thirdly, embodiments of this application provide a Layer 2 data transmission device applied to a first PE device in an L2VPN network, the device comprising:

[0034] The first receiving module is used to receive Layer 2 data packets via AC;

[0035] The matching module is used to match the target packet features of the Layer 2 data packet with preset ACL entries, which are used to record the packet features of the packet to be encrypted.

[0036] The encryption module is used to encrypt the Layer 2 data packet using the target key and add a control word to the Layer 2 data packet if the characteristics of the target packet match the preset ACL entry, thereby obtaining an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC.

[0037] The sending module is used to send the encrypted message to the second PE device in the L2VPN network through the PW.

[0038] In some embodiments, the sending module is further configured to send the Layer 2 data packet to the second PE device in the L2VPN network through the PW if the target packet characteristics fail to match the preset ACL entry.

[0039] In some embodiments, the encryption module is specifically used to set the flags included in the Layer 2 data packet.

[0040] In some embodiments, the first PE device enables encryption functionality, and the first PE device is configured with a first encryption attribute parameter; the apparatus further includes:

[0041] The second receiving module is used to receive the BGP route sent by the second PE device before receiving the Layer 2 data packet through the AC;

[0042] The module is configured to establish the PW if the BGP route carries a second encryption attribute parameter and the second encryption attribute parameter matches the first encryption attribute parameter, and generate the target key corresponding to the PW based on the second encryption attribute parameter; and to establish the PW if the BGP route does not carry the second encryption attribute parameter, and / or the second encryption attribute parameter does not match the first encryption attribute parameter.

[0043] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the second encrypted attribute parameter; and the parameter value subfield is used to carry the second encrypted attribute parameter.

[0044] In some embodiments, the first encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0045] Fourthly, embodiments of this application provide a Layer 2 data transmission device applied to a second PE device in an L2VPN network, the device comprising:

[0046] The first receiving module is used to receive public network data packets sent by the first PE device in the L2VPN network via PW;

[0047] The decapsulation module is used to decapsulate the public network data packets to obtain Layer 2 data packets;

[0048] The decryption module is used to decrypt the Layer 2 data packet using the target key corresponding to the PW if the Layer 2 data packet carries a control word, thereby obtaining a decrypted packet. The control word indicates that the packet is an encrypted packet.

[0049] The sending module is used to send the decrypted message through the AC associated with the PW.

[0050] In some embodiments, the sending module is further configured to send the Layer 2 data packet through the AC if the Layer 2 data packet does not carry the control word.

[0051] In some embodiments, the control word is a flag bit that has been set.

[0052] In some embodiments, the second PE device enables encryption functionality, and the second PE device is configured with a second encryption attribute parameter; the apparatus further includes:

[0053] The second receiving module is used to receive the BGP route sent by the first PE device before receiving the public network data packet sent by the first PE device in the L2VPN network through the PW.

[0054] The module is configured to establish the PW if the BGP route carries a first encryption attribute parameter and the first encryption attribute parameter matches the second encryption attribute parameter, and generate the target key corresponding to the PW based on the first encryption attribute parameter; and to establish the PW if the BGP route does not carry the first encryption attribute parameter, and / or the first encryption attribute parameter does not match the second encryption attribute parameter.

[0055] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the first encrypted attribute parameter; and the parameter value subfield is used to carry the first encrypted attribute parameter.

[0056] In some embodiments, the second encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0057] Fifthly, embodiments of this application provide a PE device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement any of the methods provided in the first aspect or any of the methods provided in the second aspect when executing the program stored in the memory.

[0058] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the methods provided in the first aspect or any of the methods provided in the second aspect.

[0059] In a seventh aspect, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods provided in the first aspect, or to perform any of the methods provided in the second aspect.

[0060] In the technical solution provided in this application embodiment, the PE device in the L2VPN network is configured with a preset ACL entry, which records the packet characteristics of data packets that need to be encrypted. For Layer 2 data packets from the CE device that need encryption, i.e., Layer 2 data packets that successfully match the preset ACL entry, the PE device encrypts the Layer 2 data packets and adds a control word to the Layer 2 data packets to distinguish between encrypted and unencrypted packets. In this way, after the remote PE device receives the data packets through the PW, it can distinguish between encrypted and unencrypted packets based on the control word, and decrypt the encrypted packets to restore the received data packets to the original Layer 2 data packets, thus achieving accurate transmission between CE devices. In this application embodiment, by optimizing the PE device, encryption processing is implemented by the PE device, and the transmission of Layer 2 data packets in the backbone network is encrypted, eliminating the need to configure an encryption device for each CE device. This improves the data transmission security in the L2VPN network while reducing the networking cost.

[0061] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0063] Figure 1 A schematic diagram of an MPLS L2VPN network;

[0064] Figure 2 for Figure 1 The diagram shows a possible network optimization scheme.

[0065] Figure 3 This is a schematic diagram of a first step in the process of providing a two-layer data transmission method according to an embodiment of this application.

[0066] Figure 4 This is a second flowchart illustrating the two-layer data transmission method provided in the embodiments of this application;

[0067] Figure 5 A schematic diagram of a process for establishing a PW on the first PE device side provided in an embodiment of this application;

[0068] Figure 6 A schematic diagram of a BGP route provided in an embodiment of this application;

[0069] Figure 7A schematic diagram of a process for establishing a PW on the second PE device side provided in this application embodiment;

[0070] Figure 8 A schematic diagram of the DH key negotiation process provided in the embodiments of this application;

[0071] Figure 9 A schematic diagram of the business processing flow provided in the embodiments of this application;

[0072] Figure 10 This is a schematic diagram of a first structure of a two-layer data transmission device provided in an embodiment of this application;

[0073] Figure 11 This is a schematic diagram of a second structure of a two-layer data transmission device provided in an embodiment of this application;

[0074] Figure 12 This is a schematic diagram of a PE device provided in an embodiment of this application. Detailed Implementation

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0076] This application belongs to the field of communication network technology and is applicable to various networking scenarios such as enterprise networks, data center networks, and Fiber To The Room (FTTR) networks. It can be deployed in the provider edge (PE) device of a Layer 2 Virtual Private Network (L2VPN) to achieve secure data transmission. In an FTTR network environment, this application can be used to optimize data transmission between multiple terminals, but its application scope is not limited to FTTR scenarios.

[0077] like Figure 1The illustrated Multi-Protocol Label Switching (MPLS) L2VPN network deploys PE_1 and PE_2 devices in the MPLS backbone, establishing a PW_1 connection between them. In user network 1, CE_1 is deployed, connected to PE_1 via AC_1. In user network 2, CE_2 is deployed, connected to PE_2 via AC_2. AC_1 and AC_2 are associated with PW_1 respectively.

[0078] When CE_1 sends Layer 2 data to CE_2, CE_1 sends the original Layer 2 data packet to PE_1 via AC_1. After receiving the original Layer 2 data packet via AC_1, PE_1 encapsulates it with a PW_1 tag based on the PW_1 associated with AC_1, obtaining a public network data packet. This public network data packet is then forwarded to the remote PE_2 device via the public network tunnel. Upon receiving the public network data packet, PE_2 determines its PW_1 based on the PW_1 tag, identifies the associated AC_2, and restores the public network data packet to its original Layer 2 data packet. This original Layer 2 data packet is then sent to CE_2 via AC_2. This Layer 2 data transmission is transparent throughout the network, posing a security risk.

[0079] IPsec technology is used in L3VPN networks to encrypt IP data packets; that is, it encrypts data packets transmitted based on the IP address in the IP header. L2VPN networks, however, do not transmit data packets based on the IP address in the IP header. Figure 1 The illustrated embodiment is based on PW label transmission of data packets, and some data packets in the L2VPN network do not have IP headers. Therefore, IPsec technology cannot be adapted to the secure transmission of data packets in the L2VPN network.

[0080] To meet the data security transmission requirements in an L2VPN network, users need to configure an encryption device for the CE device. Figure 1 Taking the L2VPN network shown as an example, encryption device 1 is configured for CE_1 device, and encryption device 1 is connected to PE_1 device through AC_1; encryption device 2 is configured for CE_2 device, and encryption device 2 is connected to PE_2 device through AC_2, as shown. Figure 2 As shown.

[0081] When CE_1 sends Layer 2 data to CE_2, CE_1 sends the original Layer 2 data packet to encryption device 1. Encryption device 1 encrypts the original Layer 2 data packet to obtain an encrypted data packet, and then sends the encrypted data packet to PE_1 via AC_1. After receiving the encrypted data packet via AC_1, PE_1 encapsulates the encrypted data packet with a PW_1 tag based on the PW_1 associated with AC_1, obtaining a public network data packet, and forwards the public network data packet to the remote PE_2 device through the public network tunnel. Upon receiving the public network data packet, PE_2 determines the PW_1 to which the public network data packet belongs based on the PW_1 tag carried in the public network data packet, and then determines the AC_2 associated with PW_1, and restores the public network data packet to an encrypted data packet, which is then sent to encryption device 2 via AC_2. Encryption device 2 decrypts the encrypted data packet to the original Layer 2 data packet and sends the original Layer 2 data packet to CE_2.

[0082] In this solution, users need to configure an encryption device for each CE device, which increases the expenditure on purchasing equipment and the networking cost.

[0083] To improve data transmission security while reducing networking costs in L2VPN networks, this application provides a Layer 2 data transmission method, such as... Figure 3 As shown, the method applied to the first PE device in an L2VPN network includes the following steps:

[0084] Step S301: Receive Layer 2 data packets via AC;

[0085] Step S302: Match the target packet characteristics of the Layer 2 data packet with the preset ACL entries. The preset ACL entries are used to record the packet characteristics of the packet to be encrypted.

[0086] Step S303: If the target packet characteristics match the preset ACL entry, the target key is used to encrypt the Layer 2 data packet and add a control word to the Layer 2 data packet to obtain an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC.

[0087] Step S304: Send encrypted messages to the second PE device in the L2VPN network via PW.

[0088] In the technical solution provided in this application embodiment, the PE device in the L2VPN network is configured with a preset ACL entry, which records the packet characteristics of data packets that need to be encrypted. For Layer 2 data packets from the CE device that need encryption, i.e., Layer 2 data packets that successfully match the preset ACL entry, the PE device encrypts the Layer 2 data packets and adds a control word to the Layer 2 data packets to distinguish between encrypted and unencrypted packets. In this way, after the remote PE device receives the data packets through the PW, it can distinguish between encrypted and unencrypted packets based on the control word, and decrypt the encrypted packets to restore the received data packets to the original Layer 2 data packets, thus achieving accurate transmission between CE devices. In this application embodiment, by optimizing the PE device, encryption processing is implemented by the PE device, and the transmission of Layer 2 data packets in the backbone network is encrypted, eliminating the need to configure an encryption device for each CE device. This improves the data transmission security in the L2VPN network while reducing the networking cost.

[0089] Furthermore, in an FTTR network environment, the embodiments of this application can further combine physical topology clarity to perform more granular performance optimization of FTTR devices, thereby further improving network security and reducing networking costs in FTTR scenarios.

[0090] In this embodiment, the first PE device can be any PE device in the L2VPN network. The first PE device enables encryption and is configured with one or more Access Control List (ACL) entries, i.e., preset ACL entries. The preset ACL entries include the message characteristics of the message to be encrypted. The message characteristics can be set according to actual needs. For example, the message characteristics may include a five-tuple, a Virtual Local Area Network (VLAN) identifier, an AC identifier, etc.

[0091] In step S301 above, the first PE device is connected to one or more CE devices. The AC in step S301 is the AC between the first PE device and any CE device. The CE device sends the original Layer 2 data packets to the first PE device through the AC, and then the first PE device receives the Layer 2 data packets sent by the CE device through the AC.

[0092] In step S302 above, after receiving the Layer 2 data packet, the first PE device extracts the packet characteristics of the Layer 2 data packet, namely the target packet characteristics, and matches the target packet characteristics with each preset ACL entry.

[0093] If the target packet characteristics successfully match a preset ACL entry (i.e., the packet characteristics included in the preset ACL entry are consistent with the target packet characteristics), then the Layer 2 data packet needs to be transmitted encrypted, and step S303 is executed for encryption processing. If the target packet characteristics fail to match a preset ACL entry (i.e., the packet characteristics included in the preset ACL entry are inconsistent with the target packet characteristics), then the Layer 2 data packet does not need to be transmitted encrypted. The first PE device can then forward the Layer 2 data packet according to existing technology, such as sending the Layer 2 data packet to the second PE device in the L2VPN network through the PW associated with the AC. That is, based on the PW associated with the AC, the Layer 2 data packet is encapsulated into a public network data packet, and then sent to the second PE device through the PW associated with the AC. The second PE device is the PE device in the L2VPN network connected to the first PE device via a PW.

[0094] In step S303 above, the target key is the key corresponding to the PW associated with the AC. The first PE device is also configured with an encryption algorithm, which can be Advanced Encryption Standard-Counter Mode (AES-CTR)-128, AES-CTR-192, AES-CTR-256, Camellia-Cipher Block Chaining (Camellia-CBC)-128, Camellia-CBC-192, Camellia-CBC-256, Galois Message Authentication Code (GMAC)-128, GMAC-192, GMAC-256, Galois / Counter Modem (GCM)-128, GCM-192, GCM-256, etc., without limitation.

[0095] If the target packet characteristics successfully match a preset ACL entry, the first PE device can use the configured encryption algorithm and target key to encrypt the Layer 2 data packet and add a control word to it. The resulting packet after adding the control word and encryption is the encrypted packet.

[0096] In some embodiments, the control word is carried by flags included in the Layer 2 data packet. In this case, adding a control word to the Layer 2 data packet can be done by setting the flags included in the Layer 2 data packet.

[0097] Generally, in a Layer 2 data packet, Flags are located in bits [4:7], and each bit is 0, i.e., "0000" in binary. In this embodiment, when it is determined that a Layer 2 data packet needs to be transmitted encrypted, the first PE device sets the flag bits included in the Layer 2 data packet, such as setting them to "0001" or "1111", etc., depending on the actual needs.

[0098] In this embodiment, control words are carried by setting flag bits, eliminating the need to add new fields to the Layer 2 data packet. This adapts to existing transmission protocols, is easy to implement, and does not increase the consumed transmission bandwidth. Furthermore, using flag bits to distinguish between encrypted and unencrypted packets allows for flexible encryption of services and packets.

[0099] In step S304 above, the second PE device is the PE device connected to the first PE device in the L2VPN network via a PW. After obtaining the encrypted message, a PW tag is added to the encrypted message according to the PW associated with the AC to obtain the public network data message, and the public network data message is sent to the second PE device through the PW associated with the AC.

[0100] Corresponding to the Layer 2 data transmission method applied to the first PE device described above, this application embodiment also provides a Layer 2 data transmission method, such as... Figure 4 As shown, the method for the second PE device applied in an L2VPN network includes the following steps:

[0101] Step S401: Receive public network data packets sent by the first PE device in the L2VPN network via PW;

[0102] Step S402: Decapsulate the public network data packet to obtain a Layer 2 data packet;

[0103] Step S403: If the Layer 2 data packet carries a control word, the Layer 2 data packet is decrypted using the target key corresponding to the PW to obtain a decrypted packet. The control word indicates that the packet is an encrypted packet.

[0104] Step S404: Send a decryption message through the AC associated with the PW.

[0105] In the technical solution provided in this application embodiment, the PE device in the L2VPN network is configured with a preset ACL entry, which records the packet characteristics of data packets that need to be encrypted. For Layer 2 data packets from the CE device that need encryption, i.e., Layer 2 data packets that successfully match the preset ACL entry, the PE device encrypts the Layer 2 data packets and adds a control word to the Layer 2 data packets to distinguish between encrypted and unencrypted packets. In this way, after the remote PE device receives the data packets through the PW, it can distinguish between encrypted and unencrypted packets based on the control word, and decrypt the encrypted packets to restore the received data packets to the original Layer 2 data packets, thus achieving accurate transmission between CE devices. In this application embodiment, by optimizing the PE device, encryption processing is implemented by the PE device, and the transmission of Layer 2 data packets in the backbone network is encrypted, eliminating the need to configure an encryption device for each CE device. This improves the data transmission security in the L2VPN network while reducing the networking cost.

[0106] In step S401 above, the second PE device connects to the first PE device via a PW. The first PE device sends public network data packets to the second PE device via the PW, and the second PE device receives the public network data packets via the PW. The specific process of sending public network data packets can be found above. Figure 3 Related descriptions for some parts.

[0107] In step S402 above, after receiving the public network data packet, the second PE device decapsulates the public network data packet, such as removing the PW tag carried by the public network data packet, to obtain a Layer 2 data packet. This Layer 2 data packet can be an encrypted packet, such as the encrypted packet obtained in step S303 above, or it can be an unencrypted packet.

[0108] In step S403 above, the target key is the key corresponding to PW. The second PE device is also configured with an encryption algorithm, which can be AES-CTR-128, AES-CTR-192, AES-CTR-256, Camellia-CBC-128, Camellia-CBC-192, Camellia-CBC-256, GMAC-128, GMAC-192, GMAC-256, GCM-128, GCM-192, GCM-256, etc., and there is no limitation on this.

[0109] After receiving the Layer 2 data packet, the second PE device checks whether the Layer 2 data packet carries a control word. If a control word is detected, it indicates that the Layer 2 data packet is encrypted. The second PE device can use the configured encryption algorithm and target key to decrypt the Layer 2 data packet. The decrypted packet is the decrypted packet, which can also be understood as the original Layer 2 data packet. Then, step S404 is executed, sending the decrypted packet to the corresponding CE device through the AC associated with the PW.

[0110] In this embodiment of the application, after the second PE device decrypts the Layer 2 data packet, it can also delete the control word. The packet obtained after decryption and decryption is the decrypted packet, so as to ensure that the decrypted packet is consistent with the original Layer 2 data packet and avoid misprocessing by the destination CE device.

[0111] If the second PE device detects that the Layer 2 data packet does not carry a control word, it means that the Layer 2 data packet is an unencrypted packet. This Layer 2 data packet is the original Layer 2 data packet. The second PE device can send the Layer 2 data packet directly to the corresponding CE device through the AC associated with the PW, according to existing technology.

[0112] In some embodiments, the control word is carried by flags included in the Layer 2 data packet. In this case, the control word can be the set flags, that is, the value of the set flags is the control word.

[0113] In general, in a Layer 2 data packet, Flags are located in bits [4:7], and each bit is 0, i.e., "0000" in binary. In this embodiment, when it is determined that a Layer 2 data packet needs to be transmitted encrypted, the first PE device sets the flag bits included in the Layer 2 data packet, such as setting them to "0001" or "1111".

[0114] In this embodiment, the control word is carried by setting a flag, which eliminates the need to add new fields to the Layer 2 data packet. This is compatible with existing transmission protocols, easy to implement, and does not increase the transmission bandwidth consumed.

[0115] In some embodiments, the first PE device may enable encryption functionality and is configured with a first encryption attribute parameter. The second PE device may also enable encryption functionality and is configured with a second encryption attribute parameter. The first encryption attribute parameter may include at least one of the following: encryption algorithm, key exchange parameters, key lifespan, and temporary random number. The second encryption attribute parameter may include at least one of the following: encryption algorithm, key exchange parameters, key lifespan, and temporary random number. The specific information included in the first and second encryption attribute parameters can be determined based on the key negotiation algorithm.

[0116] Before transmitting Layer 2 data packets between the first PE device and the second PE device, a PW is established between the first PE device and the second PE device.

[0117] When the encryption function is enabled on the first PE device and the first PE device is configured with the first encryption attribute parameter, the process of establishing a PW on the first PE device side can be found here. Figure 5 As shown, it includes the following steps:

[0118] Step S501: Receive the BGP route sent by the second PE device;

[0119] In this embodiment, when establishing a PW between the first PE device and the second PE device, the first PE device and the second PE device send BGP routes to each other. The type of BGP route can be determined according to the type of L2VPN. Taking Ethernet Virtual Private Network (EVPN) L2VPN as an example, the BGP route can be an Ethernet auto-discovery route or an Ethernet segment route.

[0120] When the second PE device has encryption enabled and is configured with a second encryption attribute parameter, the BGP route carries the second encryption attribute parameter. If the second PE device has encryption disabled, and / or is configured with a second encryption attribute parameter, the BGP route does not carry the second encryption attribute parameter.

[0121] In some embodiments, a BGP route may carry an authentication attribute field, which includes a type subfield and a value subfield; the type subfield carries the type of the second encryption attribute parameter; and the value subfield carries the second encryption attribute parameter. In this case, the structure of the BGP route is shown below. Figure 6 As shown, it includes the Route Distinguisher (RD), Ethernet Segment Identifier (ESI), Ethernet Tag Identifier (ETI), MPLS Label, and authentication attributes. Figure 6 The example provided is based solely on the authentication attribute having a length of 18 bytes, with the type subfield having a length of 2 bytes and the parameter value subfield having a length of 16 bytes. This is not intended to be a limitation.

[0122] In this embodiment, the specific values ​​carried by the `type` and `value` subfields are determined based on the second encryption attribute parameters. Taking the second encryption attribute parameters as an example, which include the encryption algorithm, key exchange parameters, key lifespan, and temporary random number, the configuration of the specific values ​​carried by the `type` and `value` subfields can be as follows:

[0123] When the type subfield carries a value of 0, it means that the value subfield is used to carry the encryption algorithm; when the type subfield carries a value of 1, it means that the value subfield is used to carry the key exchange parameters; when the type subfield carries a value of 2, it means that the value subfield is used to carry the key lifespan, which is in seconds; when the type subfield carries a value of 3, it means that the value subfield is used to carry temporary random numbers (nonces).

[0124] When the key exchange algorithm is the Diffie-Hellman (DH) key exchange algorithm, the key exchange parameters can be a key group, namely the base g and the modulus p. The definition of the key group can be found in Table 1 below.

[0125] Table 1

[0126]

[0127] The newly added authentication attribute field enables the transmission of encryption attribute parameters, facilitating subsequent key negotiation and generation, and ensuring secure data transmission.

[0128] Step S502: If the BGP route carries a second encryption attribute parameter and the second encryption attribute parameter matches the first encryption attribute parameter, then a PW is established, and a target key corresponding to the PW is generated based on the second encryption attribute parameter.

[0129] Step S503: If the BGP route does not carry the second encryption attribute parameter, and / or the second encryption attribute parameter does not match the first encryption attribute parameter, then a PW is established.

[0130] In this embodiment, after receiving a BGP route, if the BGP route carries a second encryption attribute parameter, the first PE device extracts the second encryption attribute parameter from the BGP route and matches it with the first encryption attribute parameter. If the second encryption attribute parameter matches the first encryption attribute parameter (e.g., the second encryption attribute parameter and the first encryption attribute parameter include the same encryption algorithm, key exchange parameters, and key lifespan), the first PE device establishes a PW and generates a target key based on the second encryption attribute parameter (e.g., encryption algorithm, key exchange parameters, key lifespan, and temporary random number), and associates the target key with the PW. If the second encryption attribute parameter does not match the first encryption attribute parameter (e.g., at least one of the encryption algorithm, key exchange parameters, and key lifespan included in the second encryption attribute parameter and the first encryption attribute parameter is different), the first PE device establishes the PW without generating a target key.

[0131] After receiving a BGP route, if the BGP route does not carry the second encryption attribute parameter, the first PE device will establish a PW (Programmable Wire) instead of generating a target key.

[0132] When the encryption function is enabled on the second PE device and the second PE device is configured with the second encryption attribute parameter, the process of establishing a PW on the second PE device side can be found in [reference needed]. Figure 7 As shown, it includes the following steps:

[0133] Step S701: Receive the BGP route sent by the first PE device;

[0134] In this embodiment of the application, when establishing a PW between the first PE device and the second PE device, the first PE device and the second PE device send BGP routes to each other. The type of BGP route can be determined according to the type of L2VPN.

[0135] When the first PE device has encryption enabled and is configured with a first encryption attribute parameter, the BGP route carries the first encryption attribute parameter. If the first PE device has encryption disabled, and / or is configured with a first encryption attribute parameter, the BGP route does not carry the first encryption attribute parameter.

[0136] In some embodiments, a BGP route may carry an authentication attribute field, which includes a type subfield and a value field; the type subfield carries the type of the first encrypted attribute parameter; and the value subfield carries the first encrypted attribute parameter. In this case, the structure of the BGP route is shown below. Figure 6 As shown.

[0137] In this embodiment, the specific values ​​carried by the `type` and `value` subfields are determined based on the first encryption attribute parameters. Taking the first encryption attribute parameters as an example, which include the encryption algorithm, key exchange parameters, key lifespan, and temporary random number, the configuration of the specific values ​​carried by the `type` and `value` subfields can be as follows:

[0138] When the `type` subfield carries a value of 0, it indicates that the `value` subfield is used to carry the encryption algorithm; when the `type` subfield carries a value of 1, it indicates that the `value` subfield is used to carry key exchange parameters; when the `type` subfield carries a value of 2, it indicates that the `value` subfield is used to carry the key lifetime, in seconds; when the `type` subfield carries a value of 3, it indicates that the `value` subfield is used to carry temporary random numbers (nonces). When the key exchange algorithm is the DH key exchange algorithm, the key exchange parameters can be a key group, i.e., the base `g` and the modulus `p`. The definition of a key group can be found in Table 1 above.

[0139] The newly added authentication attribute field enables the transmission of encryption attribute parameters, facilitating subsequent key negotiation and generation, and ensuring secure data transmission.

[0140] Step S702: If the BGP route carries the first encryption attribute parameter and the first encryption attribute parameter matches the second encryption attribute parameter, then a PW is established, and the target key corresponding to the PW is generated according to the first encryption attribute parameter.

[0141] Step S703: If the BGP route does not carry the first encryption attribute parameter, and / or the first encryption attribute parameter does not match the second encryption attribute parameter, then a PW is established.

[0142] In this embodiment, after receiving a BGP route, if the BGP route carries a first encryption attribute parameter, the second PE device extracts the first encryption attribute parameter from the BGP route and matches the second encryption attribute parameter with the first encryption attribute parameter. If the second encryption attribute parameter matches the first encryption attribute parameter, such as including the same encryption algorithm, key exchange parameters, and key lifespan, the second PE device establishes a PW and generates a target key based on the first encryption attribute parameter (such as encryption algorithm, key exchange parameters, key lifespan, and temporary random number), and associates the target key with the PW. If the second encryption attribute parameter does not match the first encryption attribute parameter, such as at least one of the encryption algorithm, key exchange parameters, and key lifespan being different, the second PE device establishes the PW without generating a target key.

[0143] After receiving a BGP route, if the BGP route does not carry the first encryption attribute parameter, the second PE device will establish a PW instead of generating a target key.

[0144] In the technical solution provided in this application embodiment, the first PE device and the second PE device achieve key negotiation during the PW establishment process through BGP routing, laying the foundation for subsequent secure data transmission.

[0145] After the PW is established, the first PE device and the second PE device can perform the above operations. Figure 3 and Figure 4 The example shown.

[0146] The following is combined Figure 1 The MPLS L2VPN network shown is as follows: Figure 8 The DH key negotiation process is shown below. Figure 9 The illustrated business processing flow describes the Layer 2 data transmission method provided in this application embodiment. The technical solution provided in this application embodiment can be divided into two stages: the key negotiation stage and the business processing stage.

[0147] (1) Key negotiation phase.

[0148] L2VPN services are established on PE_1 (e.g., the first PE device) and PE_2 (e.g., the second PE device), respectively. Encryption functions, encryption algorithms, DH key exchange parameters, control words, and ACLs are enabled via commands. Each ACL contains multiple entries, and each entry records the packet characteristics of the data packets to be encrypted. The DH key exchange parameters include the base g and the modulus p.

[0149] The PE_1 device generates a random number 'a', and performs a modulo-exponential operation based on its configured DH key exchange parameters (i.e., g1 and p1) to obtain a temporary random number 'c'. PE_1 sends BGP route 1 to PE_2. The authentication attribute fields in BGP route 1 include {(type=0, value=encryption algorithm 1), (type=1, value=g1, p1), (type=2, value=100 seconds), (type=3, value=c)}. PE_2 generates a random number b and, based on its configured DH key exchange parameters (i.e., g2 and p2), performs a modulo-exponential operation to obtain a temporary random number d. The PE_2 device sends BGP route 2 to the PE_1 device. The authentication attribute fields in BGP route 2 include {(type=0, value=encryption algorithm 2), (type=1, value=g2, p2), (type=2, value=100 seconds), (type=3, value=d)}.

[0150] After receiving BGP route 2, device PE_1 determines that encryption algorithm 1 and encryption algorithm 2, and that g1 and p1 are the same as g2 and p2, then calculates the shared key K1 according to the DH key negotiation algorithm, i.e. After receiving BGP route 1, PE_2 device determines that encryption algorithm 1 is the same as encryption algorithm 2, and g1 and p1 are the same as g2 and p2. Then, it calculates the shared key K2 according to the DH key negotiation algorithm. After establishing PW_1 between PE_1 and PE_2, shared keys K1 and K2 are associated with PW_1.

[0151] The DH key negotiation algorithm has a very high computational complexity. Using the DH key negotiation algorithm can ensure that both parties in the PE device can securely obtain key information.

[0152] (2) Business processing stage.

[0153] Device CE_1 sends Layer 2 data packet 1 to device PE_1 via AC_1, meaning Layer 2 data packet 1 enters device PE_1 via AC_1. Device PE_1 matches the packet characteristics of Layer 2 data packet 1 against ACL entries. If a match is successful, device PE_1 uses encryption algorithm 1 and shared key K1 (i.e., the target key) to encrypt Layer 2 data packet 1, and sets the flags in Layer 2 data packet 1, resulting in encrypted packet 1. Device PE_1 then performs MPLS encapsulation based on the PW_1 associated with AC_1, i.e., encapsulates the encrypted packet 1 with a PW_1 tag, resulting in public network data packet 1, which is then forwarded to device PE_2 via the public network tunnel. After receiving public network data packet 1, device PE_2 performs MPLS decapsulation on public network data packet 1, obtaining the PW_1 tag. The PE_2 device detects that the flags are set, meaning that the message obtained by MPLS decapsulation is encrypted message 1. Based on encryption algorithm 2 and shared key K2, the encrypted message 1 is decrypted to obtain layer 2 data message 1. Then, the layer 2 data message 1 is sent to the CE_2 device through AC_2 associated with PW_1.

[0154] Device CE_1 sends Layer 2 data packet 2 to device PE_1 via AC_1, meaning Layer 2 data packet 2 enters device PE_1 via AC_1. Device PE_1 matches the packet characteristics of Layer 2 data packet 2 against ACL entries. If the match fails, the normal L2VPN forwarding process is executed, which involves directly performing MPLS encapsulation based on PW_1 associated with AC_1 to obtain public network data packet 2, and forwarding public network data packet 2 to device PE_2 through the public network tunnel. After receiving public network data packet 2, device PE_2 performs MPLS decapsulation on public network data packet 2 to obtain the PW_1 label. Device PE_2 finds that the flags are not set, meaning the packet obtained from MPLS decapsulation is the original Layer 2 data packet 2, and then executes the normal L2VPN forwarding process, which involves directly sending Layer 2 data packet 2 to device CE_2 via AC_2 associated with PW_1.

[0155] The technical solution provided in this application solves the problem that L2VPN scenarios cannot directly encrypt data. It enables encryption on the PE device, eliminating the need to encrypt packets in advance on the CE device, thus reducing the requirements for the CE device and saving customers' budget and reducing networking costs.

[0156] Furthermore, when the Layer 2 data packet is not an IP packet, IPsec technology cannot directly encrypt it. It is necessary to first encapsulate the IP header using Generic Routing Encapsulation (GRE) or similar methods before performing IPsec encryption. The technical solution provided in the embodiments of this application can circumvent this problem.

[0157] Corresponding to the above-described Layer 2 data transmission method, this application also provides a Layer 2 data transmission apparatus, such as... Figure 10 As shown, the first PE device used in an L2VPN network includes:

[0158] The first receiving module 1001 is used to receive Layer 2 data packets through AC;

[0159] The matching module 1002 is used to match the target packet characteristics of the Layer 2 data packet with the preset ACL entries. The preset ACL entries are used to record the packet characteristics of the packet to be encrypted.

[0160] The encryption module 1003 is used to encrypt the Layer 2 data packet using the target key if the characteristics of the target packet match the preset ACL entry, and add a control word to the Layer 2 data packet to obtain an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC.

[0161] The sending module 1004 is used to send encrypted messages to the second PE device in the L2VPN network via the PW.

[0162] In some embodiments, the sending module 1004 is further configured to send a Layer 2 data packet to the second PE device in the L2VPN network via PW if the target packet characteristics fail to match the preset ACL entry.

[0163] In some embodiments, the encryption module 1003 is specifically used to set the flags included in the Layer 2 data packet.

[0164] In some embodiments, the first PE device enables encryption and is configured with a first encryption attribute parameter; the aforementioned Layer 2 data transmission device further includes:

[0165] The second receiving module is used to receive the BGP route sent by the second PE device before receiving the Layer 2 data packet through the AC;

[0166] The module is configured to establish a PW if the BGP route carries a second encryption attribute parameter and the second encryption attribute parameter matches the first encryption attribute parameter, and generate the target key corresponding to the PW based on the second encryption attribute parameter; and to establish a PW if the BGP route does not carry the second encryption attribute parameter, and / or the second encryption attribute parameter does not match the first encryption attribute parameter.

[0167] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the second encrypted attribute parameter; and the parameter value subfield is used to carry the second encrypted attribute parameter.

[0168] In some embodiments, the first encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0169] In the technical solution provided in this application embodiment, the PE device in the L2VPN network is configured with a preset ACL entry, which records the packet characteristics of data packets that need to be encrypted. For Layer 2 data packets from the CE device that need encryption, i.e., Layer 2 data packets that successfully match the preset ACL entry, the PE device encrypts the Layer 2 data packets and adds a control word to the Layer 2 data packets to distinguish between encrypted and unencrypted packets. In this way, after the remote PE device receives the data packets through the PW, it can distinguish between encrypted and unencrypted packets based on the control word, and decrypt the encrypted packets to restore the received data packets to the original Layer 2 data packets, thus achieving accurate transmission between CE devices. In this application embodiment, by optimizing the PE device, encryption processing is implemented by the PE device, and the transmission of Layer 2 data packets in the backbone network is encrypted, eliminating the need to configure an encryption device for each CE device. This improves the data transmission security in the L2VPN network while reducing the networking cost.

[0170] Corresponding to the above-described Layer 2 data transmission method, this application also provides a Layer 2 data transmission apparatus, such as... Figure 11 As shown, a second PE device is used in an L2VPN network. This device includes:

[0171] The first receiving module 1101 is used to receive public network data packets sent by the first PE device in the L2VPN network via PW;

[0172] The decapsulation module 1102 is used to decapsulate public network data packets to obtain Layer 2 data packets;

[0173] The decryption module 1103 is used to decrypt the Layer 2 data packet using the target key corresponding to PW if the Layer 2 data packet carries a control word, so as to obtain a decrypted message. The control word indicates that the message is an encrypted message.

[0174] The sending module 1104 is used to send decryption messages through the AC associated with the PW.

[0175] In some embodiments, the sending module 1104 is further configured to send a Layer 2 data packet via the AC if the Layer 2 data packet does not carry a control word.

[0176] In some embodiments, the control word is a flag bit that has been set.

[0177] In some embodiments, the second PE device enables encryption functionality and is configured with a second encryption attribute parameter; the aforementioned Layer 2 data transmission device further includes:

[0178] The second receiving module is used to receive the BGP route sent by the first PE device before receiving the public network data packets sent by the first PE device in the L2VPN network through the PW.

[0179] The module is configured to establish a PW if the BGP route carries a first encryption attribute parameter and the first encryption attribute parameter matches the second encryption attribute parameter, and generate the target key corresponding to the PW based on the first encryption attribute parameter; and to establish a PW if the BGP route does not carry the first encryption attribute parameter, and / or the first encryption attribute parameter does not match the second encryption attribute parameter.

[0180] In some embodiments, the BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the first encrypted attribute parameter; the parameter value subfield is used to carry the first encrypted attribute parameter.

[0181] In some embodiments, the second encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

[0182] In the technical solution provided in this application embodiment, the PE device in the L2VPN network is configured with a preset ACL entry, which records the packet characteristics of data packets that need to be encrypted. For Layer 2 data packets from the CE device that need encryption, i.e., Layer 2 data packets that successfully match the preset ACL entry, the PE device encrypts the Layer 2 data packets and adds a control word to the Layer 2 data packets to distinguish between encrypted and unencrypted packets. In this way, after the remote PE device receives the data packets through the PW, it can distinguish between encrypted and unencrypted packets based on the control word, and decrypt the encrypted packets to restore the received data packets to the original Layer 2 data packets, thus achieving accurate transmission between CE devices. In this application embodiment, by optimizing the PE device, encryption processing is implemented by the PE device, and the transmission of Layer 2 data packets in the backbone network is encrypted, eliminating the need to configure an encryption device for each CE device. This improves the data transmission security in the L2VPN network while reducing the networking cost.

[0183] This application also provides a PE device, such as... Figure 12 As shown, it includes a processor 1201, a communication interface 1202, a memory 1203, and a communication bus 1204, wherein the processor 1201, the communication interface 1202, and the memory 1203 communicate with each other through the communication bus 1204.

[0184] Memory 1203 is used to store computer programs;

[0185] When the processor 1201 executes the program stored in the memory 1203, it implements any of the two-layer data transmission methods applied to the first PE device or any of the two-layer data transmission methods applied to the second PE device.

[0186] The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0187] The communication interface is used for communication between the PE device and other devices.

[0188] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0189] The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0190] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program. When the computer program is executed by a processor, it implements any of the above-described two-layer data transmission methods applied to the first PE device, or implements any of the above-described two-layer data transmission methods applied to the second PE device.

[0191] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the above-described Layer 2 data transmission methods applied to the first PE device, or to execute any of the above-described Layer 2 data transmission methods applied to the second PE device.

[0192] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0193] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0194] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for apparatus, PE devices, storage media, and program products are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0195] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A two-layer data transmission method, characterized in that, The method, applied to the first PE device in an L2VPN network, includes: Receive Layer 2 data packets via AC; The target message characteristics of the Layer 2 data packet are matched with a preset ACL entry, which is used to record the message characteristics of the message to be encrypted. If the target packet characteristics match the preset ACL entry, the target key is used to encrypt the Layer 2 data packet, and a control word is added to the Layer 2 data packet to obtain an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC. The encrypted message is sent to the second PE device in the L2VPN network via the PW.

2. The method according to claim 1, characterized in that, The method further includes: If the target packet characteristics fail to match the preset ACL entry, the Layer 2 data packet is sent to the second PE device in the L2VPN network via the PW.

3. The method according to claim 1 or 2, characterized in that, Adding control words to the Layer 2 data packet includes setting the flags included in the Layer 2 data packet to bits.

4. The method according to claim 1 or 2, characterized in that, The first PE device has its encryption function enabled, and the first PE device is configured with a first encryption attribute parameter; before receiving Layer 2 data packets via AC, the method further includes: Receive the BGP route sent by the second PE device; If the BGP route carries a second encryption attribute parameter, and the second encryption attribute parameter matches the first encryption attribute parameter, then the PW is established, and the target key corresponding to the PW is generated according to the second encryption attribute parameter; If the BGP route does not carry the second encryption attribute parameter, and / or the second encryption attribute parameter does not match the first encryption attribute parameter, then the PW is established.

5. The method according to claim 4, characterized in that, The BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the second encryption attribute parameter; and the parameter value subfield is used to carry the second encryption attribute parameter.

6. The method according to claim 4, characterized in that, The first encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

7. A two-layer data transmission method, characterized in that, The method, applied to a second PE device in an L2VPN network, includes: Through PW, receive public network data packets sent by the first PE device in the L2VPN network; The public network data packets are decapsulated to obtain Layer 2 data packets; If the Layer 2 data packet carries a control word, the Layer 2 data packet is decrypted using the target key corresponding to the PW to obtain a decrypted packet. The control word indicates that the packet is an encrypted packet. The decryption message is sent through the AC associated with the PW.

8. The method according to claim 7, characterized in that, The method further includes: If the Layer 2 data packet does not carry the control word, then the Layer 2 data packet is sent through the AC.

9. The method according to claim 7 or 8, characterized in that, The control word is the flag bit after it has been set.

10. The method according to claim 7, characterized in that, The second PE device has encryption enabled, and the second PE device is configured with a second encryption attribute parameter; Before receiving public network data packets sent by the first PE device in the L2VPN network via PW, the method further includes: Receive the BGP route sent by the first PE device; If the BGP route carries a first encryption attribute parameter, and the first encryption attribute parameter matches the second encryption attribute parameter, then the PW is established, and the target key corresponding to the PW is generated according to the first encryption attribute parameter. If the BGP route does not carry the first encryption attribute parameter, and / or the first encryption attribute parameter does not match the second encryption attribute parameter, then the PW is established.

11. The method according to claim 10, characterized in that, The BGP route carries an authentication attribute field, which includes a type subfield and a parameter value subfield; the type subfield is used to carry the type of the first encrypted attribute parameter; and the parameter value subfield is used to carry the first encrypted attribute parameter.

12. The method according to claim 10, characterized in that, The second encryption attribute parameter includes at least one of the following: encryption algorithm, key exchange parameters, key lifespan and temporary random number.

13. A two-layer data transmission device, characterized in that, The first PE device used in an L2VPN network includes: The first receiving module is used to receive Layer 2 data packets via AC; The matching module is used to match the target packet features of the Layer 2 data packet with preset ACL entries, which are used to record the packet features of the packet to be encrypted. The encryption module is used to encrypt the Layer 2 data packet using the target key and add a control word to the Layer 2 data packet if the characteristics of the target packet match the preset ACL entry, thereby obtaining an encrypted packet. The control word indicates that the packet is an encrypted packet, and the target key corresponds to the PW associated with the AC. The sending module is used to send the encrypted message to the second PE device in the L2VPN network through the PW.

14. A two-layer data transmission device, characterized in that, A second PE device used in an L2VPN network, the device comprising: The first receiving module is used to receive public network data packets sent by the first PE device in the L2VPN network via PW; The decapsulation module is used to decapsulate the public network data packets to obtain Layer 2 data packets; The decryption module is used to decrypt the Layer 2 data packet using the target key corresponding to the PW if the Layer 2 data packet carries a control word, thereby obtaining a decrypted packet. The control word indicates that the packet is an encrypted packet. The sending module is used to send the decrypted message through the AC associated with the PW.

15. A PE device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor, when executing the program stored in the memory, implements the method described in any one of claims 1-6, or implements the method described in any one of claims 7-12.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1-6, or the method of any one of claims 7-12.

Images