Method for securely transmitting packet, and related device

Abstract

The present application provides a method for securely transmitting a packet, a method for negotiating an IPsec SA, and a related device, applied to a wide area network. In an across-multi-tunnel scenario, the IPsec SA for end-to-end security protection is negotiated between a first station edge and a second station edge on the basis of VRF granularity by extending a BGP routing. The first station edge carries out security protection on a VPN service packet on the basis of the IPsec SA, and then transmits the packet by means of an overlay end-to-end tunnel between the first station edge and the second station edge, and the second station edge processes the packet on the basis of the IPsec SA to obtain the VPN service packet. In the present application, it is only needed to carry out security protection once at the first station edge, and an intermediate node does not need to carry out encryption and decryption, thereby ensuring the secure transmission of the packet, improving the transmission efficiency and reducing the transmission delay.

Description

Method and related device for secure message transmission

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on June 30, 2023, with application number 202310803215.6 and application name “Method and Related Device for Securely Transmitting Messages”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of wide area network message transmission, and in particular to a method for securely transmitting messages and a method for negotiating IPsec SA and related devices. Background Art

[0003] Building on the underlying network, an overlay network can be constructed by establishing tunnels between multiple network nodes. The overlay network decouples services from the underlying network, enabling rapid end-to-end delivery of service packets.

[0004] However, since the tunnel is established based on the operator's network, the network cannot guarantee the security of service messages. Therefore, the tunnel itself needs to have certain security capabilities to ensure the security of service messages. The currently commonly used method is to perform key negotiation between the ingress and egress nodes of the tunnel using the Border Gateway Protocol (BGP) based on the granularity of the transport network port (TNP) when establishing the tunnel on the control plane. The key is bound to the ports of the ingress and egress nodes of the tunnel. After the tunnel is established, when the service message is transmitted in the tunnel, the ingress node encrypts the service message according to the key negotiated with the egress node, so that the service message is in an encrypted state during transmission in the tunnel. When the service message reaches the egress node of the tunnel, the egress node decrypts the service message according to the negotiated key, thereby ensuring the security of the service message transmission.

[0005] The aforementioned method of encrypting and decrypting messages based on the TNP granularity of network nodes requires that key information be negotiated between the ingress and egress nodes for each tunnel segment. When a service message is transmitted within that tunnel segment, it is encrypted according to the negotiated method at the ingress and decrypted at the egress. When a service flow needs to span multiple tunnel segments, the keys for each segment are different. Encryption must be performed at the ingress node of each tunnel segment, decryption must be performed at the egress node, encryption must be performed again at the ingress node of the next tunnel segment, and decryption must be performed again at the egress node. This cumbersome encryption and decryption operation consumes significant computing resources, increasing service message forwarding latency.

[0006] Summary of the Invention

[0007] The present application provides a method for securely transmitting messages, a method for negotiating IPsec SA, and related devices. By adopting the methods described in the present application, the message transmission efficiency can be improved and the transmission delay can be reduced.

[0008] In a first aspect, the present application provides a method for securely transmitting a message, described from the sending side of a data forwarding plane, the method comprising:

[0009] The first site egress device edge in the wide area network receives the virtual private network VPN service message in the virtual routing forwarding VRF;

[0010] The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;

[0011] The first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the first site edge is an ingress endpoint of the overlay end-to-end tunnel, the second site edge is an egress endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0012] The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.

[0013] In the solution of the present application, in a scenario where multiple tunnels are spanned between the edge of the first site and the edge of the second site, the edge of the first site and the edge of the second site have pre-negotiated an IPsecSA associated with the VRF. After the edge of the first site receives the VPN service message in the VRF, the edge of the first site performs security protection on the VPN service message according to the IPsecSA associated with the VRF negotiated with the edge of the second site to obtain a first message; then, the tunnel information of the upper-layer overlay end-to-end tunnel established between the edge of the first site and the edge of the second site is encapsulated in the outer layer of the first message to obtain a second message; then, the edge of the first site transmits the second message to the edge of the second site through the upper-layer overlay end-to-end tunnel, wherein each POP through which the overlay end-to-end tunnel passes does not need to decrypt or encrypt the second message, and only needs to forward it according to the tunnel information.

[0014] In a scenario where multiple tunnels are spanned between the edge of a first site and the edge of a second site, the present application provides a method for securely transmitting messages. This method only requires one security protection at the entry point of the overlay end-to-end tunnel established between the edges of the two sites. During the transmission process, each POP does not need to encrypt or decrypt the message, which saves computing power resources, reduces transmission delay, and improves message transmission efficiency.

[0015] Based on the first aspect, in a possible implementation, the security protection of the VPN service message includes: encrypting the VPN service message using the Encapsulating Security Payload (ESP) protocol; and / or encapsulating the VPN service message with an Authentication Header.

[0016] Based on the first aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0017] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

[0018] The overlay end-to-end tunnel can be an SRv6 tunnel. The first site edge encapsulates the tunnel information of the SRv6 tunnel in the outer layer of the first message. The tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH. Each POP on the tunnel can forward the second message based on the IPv6 header and the segment routing header SRH.

[0019] Based on the first aspect, in a possible implementation, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overlay SRv6 Policy from the first POP to the second POP according to the next-hop SID of the END.SID.

[0020] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0021] Based on the first aspect, in a possible implementation, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0022] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the General Network Virtualization Encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0023] Based on the first aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0024] Based on the first aspect, in a possible implementation, before the first site edge receives the service message, the method further includes:

[0025] The first site edge receives the Border Gateway Protocol BGP route announced by the second site edge, where the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF that matches the Export RT; based on the route type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

[0026] A new route type has been added to BGP routing, which carries IPsec SA and Export RT. The newly added route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the VPN service messages in the VRF that matches the Export RT. Through the BGP route announcement, the IPsecSA associated with the VRF is negotiated between the edge of the first site and the edge of the second site. The IPsecSA is used to provide security protection for the VPN service messages in the VRF, especially when multiple tunnels are spanned between the edge of the first site and the edge of the second site, which lays the foundation for the secure and rapid transmission of the VPN service messages. The implementation of the embodiment of the present application realizes the secure and rapid transmission of VPN service messages, reduces transmission delay, and improves transmission efficiency.

[0027] Based on the first aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0028] Based on the first aspect, in a possible implementation, the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and / or the node identifier Node ID of the second site edge. In one implementation, the identifier of the second site edge may be the second site identifier site ID and the node identifier Node ID, and the second site edge may be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge perform security protection and transmission of service messages based on the negotiated IPsec SA. In another implementation, the identifier of the second site edge may be the node identifier Node ID, and the node Node ID is globally unique in the wide area network, and the second site edge may be determined based on the Node ID. In another implementation, the identifier of the edge of the second site can be the second site identifier site ID. In this case, any edge in the first site receives the BGP route announced by any edge in the second site, and the BGP route carries the identifier of the second site and the IPsec SA, which means that the key negotiated between the first site and the second site is the IPsec SA, and the service messages between any edge in the first site and any edge in the second site can be securely protected and transmitted through the negotiated IPsec SA.

[0029] Based on the first aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0030] Based on the first aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0031] Based on the first aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0032] Based on the first aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0033] In a second aspect, the present application provides a method for securely transmitting a message, described from the receiving side of a data forwarding plane, the method comprising:

[0034] An egress device edge at a second site in a wide area network receives a second message sent by an edge at a first site through an upper-layer overlay end-to-end tunnel established between the edge at the first site and the edge at the second site, wherein the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the edge at the first site is an ingress endpoint of the overlay end-to-end tunnel, the edge at the second site is an egress endpoint of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network (VPN) service message through an Internet Protocol Security Association (IPsec) SA negotiated between the edge at the second site and the edge at the first site;

[0035] The second site edge decapsulates the second message to obtain the first message;

[0036] The second site edge processes the first message according to the IPsecSA to obtain the VPN service message.

[0037] After receiving the second message, the second message includes the first message and the tunnel information encapsulated in the first message. The second site edge decapsulates the second message to obtain the first message. It then processes the first message according to the IPsecSA negotiated with the first site edge to obtain the VPN service message. During the entire transmission process, the second message does not need to be encrypted or decrypted at each POP in the overlay end-to-end tunnel. It only needs to be processed once at the second site edge, improving transmission efficiency and reducing transmission latency.

[0038] Based on the second aspect, in a possible implementation, the processing of the first message includes: decrypting the first message using the Encapsulated Security Payload (ESP) protocol according to the IPsecSA; and / or authenticating the first message based on the authentication data carried in the IPsec SA and the authentication header of the first message.

[0039] Based on the second aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0040] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

[0041] Based on the second aspect, in a possible implementation, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overlay SRv6 Policy from the first POP to the second POP according to the next-hop SID of the END.SID.

[0042] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0043] Based on the second aspect, in a possible implementation, the first information is a first node SID of the first POP, and the operation associated with the first node SID includes:

[0044] An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

[0045] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the General Network Virtualization Encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0046] Based on the second aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0047] Based on the second aspect, in a possible implementation, before the second site export device edge in the wide area network receives the second message sent by the first site edge through the upper layer overlay end-to-end tunnel, the method also includes: the second site export device edge generates a Border Gateway Protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection for the VPN service message in the virtual routing forwarding VRF matching the Export RT; the second site edge announces the BGP route to the first site edge.

[0048] Based on the second aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0049] Based on the second aspect, in a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0050] Based on the second aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0051] Based on the second aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0052] Based on the second aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0053] Based on the second aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0054] In a third aspect, the present application provides a method for negotiating an Internet Protocol Security Association (IPsec) SA, described from the receiving side of the control plane, the method comprising:

[0055] An egress device edge at a first site in a wide area network receives a Border Gateway Protocol (BGP) route advertised by an edge at a second site, where the BGP route includes a route type RT, the IPsec SA, an identifier of the edge at the second site, and an export route target (ExportRT), wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on a service packet in a virtual routing forwarding (VRF) matching the Export RT.

[0056] According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

[0057] This application solution adds a new route type RT to BGP routing. The BGP route carries an IPsec SA and an export route target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF matched by ExportRT. By announcing the BGP route in the wide area network, end-to-end IPsec SA negotiation based on VRF granularity is achieved between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service packets later, laying the foundation for the transmission of VPN service packets.

[0058] Based on the third aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0059] Based on the third aspect, in a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0060] It can be understood that the identifier of the second site edge can be the second site identifier site ID and the node identifier Node ID. The second site edge can be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA. In another implementation, the identifier of the second site edge can be the node identifier Node ID, and the node Node ID is globally unique in the wide area network. The second site edge can be determined based on the Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA. In another implementation, the identifier of the second site edge can be the second site identifier site ID. In this case, any edge in the first site receives a BGP route announced by any edge in the second site, wherein the BGP route carries the identifier and IPsec SA of the second site, indicating that the key negotiated between the first site and the second site is the IPsec SA. Subsequently, any edge in the first site and any edge in the second site can securely protect and transmit service packets through the negotiated key IPsec SA.

[0061] Based on the third aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0062] Based on the third aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0063] Based on the third aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0064] Based on the third aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0065] In a fourth aspect, the present application provides a method for negotiating an Internet Protocol Security Association (IPsec) SA, described from the sending side of the control plane, the method comprising:

[0066] The second site egress device edge in the wide area network generates a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target (ExportRT), wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on service packets in a virtual routing forwarding (VRF) matching the Export RT;

[0067] The second site edge announces the BGP route to the first site edge.

[0068] This application solution adds a new route type RT to BGP routing. The BGP route carries an IPsec SA and an export route target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF matched by ExportRT. By announcing the BGP route in the wide area network, end-to-end IPsec SA negotiation based on VRF granularity is achieved between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service packets later, laying the foundation for the transmission of VPN service packets.

[0069] Based on the fourth aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0070] Based on the fourth aspect, in a possible implementation, the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and / or the node identifier Node ID of the second site edge. The identifier of the second site edge can be the second site identifier site ID and the node identifier Node ID. The second site edge can be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA. In another implementation, the identifier of the second site edge can be the node identifier Node ID. The node Node ID is globally unique in the wide area network. The second site edge can be determined based on the Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA. In another implementation, the identifier of the edge of the second site can be the second site identifier site ID. In this case, any edge in the first site receives the BGP route announced by any edge in the second site, where the BGP route carries the identifier of the second site and the IPsec SA, indicating that the key negotiated between the first site and the second site is the IPsec SA. Subsequently, any edge in the first site and any edge in the second site can securely protect and transmit service messages through the negotiated key IPsec SA.

[0071] Based on the fourth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0072] Based on the fourth aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0073] Based on the fourth aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0074] Based on the fourth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0075] In a fifth aspect, the present application provides a device for securely transmitting a message, the device being applied to a first site egress device edge in a wide area network, the device comprising:

[0076] A receiving module is used to receive a virtual private network VPN service message in a virtual routing forwarding VRF;

[0077] a processing module, configured to perform security protection on the VPN service message according to an Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the edge of the second site to obtain a first message;

[0078] The processing module is configured to encapsulate tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the first site edge is an ingress endpoint of the overlay end-to-end tunnel, the second site edge is an egress endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0079] A sending module is used to send the second message to the second site edge through the overlay end-to-end tunnel.

[0080] Based on the fifth aspect, in a possible implementation, the processing module is used to: perform Encapsulating Security Payload (ESP) protocol encryption on the VPN service message; and / or encapsulate an Authentication Header on the VPN service message.

[0081] Based on the fifth aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0082] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

[0083] Based on the fifth aspect, in a possible implementation method, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overly SRv6 Policy from the first POP to the second POP according to the next-hop SID of the END.SID.

[0084] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0085] Based on the fifth aspect, in a possible implementation method, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0086] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0087] Based on the fifth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0088] Based on the fifth aspect, in a possible implementation method, the receiving module is also used to receive the Border Gateway Protocol BGP route announced by the second site edge, and the BGP route includes the route type RT, the IPsec SA, the identifier of the second site edge, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection for the VPN service message in the virtual routing forwarding VRF that matches the Export RT; the processing module is also used to associate the IPsec SA with the VRF according to the route type RT and the Export RT.

[0089] Based on the fifth aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0090] Based on the fifth aspect, in a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0091] Based on the fifth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0092] Based on the fifth aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0093] Based on the fifth aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0094] Based on the fifth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0095] Each functional module in the fifth aspect is used to implement the method described in the first aspect and any possible implementation method of the first aspect.

[0096] In a sixth aspect, the present application provides a device for securely transmitting a message, the device being applied to a second site edge in a wide area network, characterized in that the device includes:

[0097] a receiving module, configured to receive a second message sent by a first site edge through an upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the first site edge is an ingress endpoint of the overlay end-to-end tunnel, the second site edge is an egress endpoint of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network (VPN) service message through an Internet Protocol Security Association (IPsec) SA negotiated between the second site edge and the first site edge;

[0098] a processing module, configured to decapsulate the second message to obtain a first message;

[0099] The processing module is further configured to process the first message according to the IPsecSA to obtain the VPN service message.

[0100] Based on the sixth aspect, in a possible implementation method, the processing module is used to: decrypt the first message using the Encapsulated Security Payload (ESP) protocol according to the IPsecSA; and / or authenticate the first message based on the authentication data carried in the IPsec SA and the authentication header of the first message.

[0101] Based on the sixth aspect, in a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

[0102] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

[0103] Based on the sixth aspect, in a possible implementation method, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overly SRv6 Policy from the first POP to the second POP according to the next-hop SID of the END.SID.

[0104] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0105] Based on the sixth aspect, in a possible implementation method, the first information is the first node SID of the first POP, and the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.

[0106] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0107] Based on the sixth aspect, in a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0108] Based on the sixth aspect, in a possible implementation,

[0109] The processing module is further configured to generate a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target (ExportRT), wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on the VPN service message in a virtual routing forwarding (VRF) matching the Export RT;

[0110] A sending module is used to notify the BGP route to the first site edge.

[0111] Based on the sixth aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0112] Based on the sixth aspect, in a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0113] Based on the sixth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0114] Based on the sixth aspect, in a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute Type-Length-Value TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0115] Based on the sixth aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0116] Based on the sixth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0117] The various functional modules in the sixth aspect are used to implement the method described in the above-mentioned second aspect and any possible implementation method of the second aspect.

[0118] In a seventh aspect, the present application provides a device for negotiating an Internet Protocol Security Association (IPsec) SA, the device being applied to a first site edge in a wide area network, the device comprising:

[0119] a receiving module, configured to receive a Border Gateway Protocol (BGP) route advertised by an edge at a second site, the BGP route including a route type (RT), the IPsec SA, an identifier of the edge at the second site, and an export route target (ExportRT), wherein the route type (RT) indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on service packets in a virtual routing forwarding (VRF) matching the Export RT;

[0120] A processing module is configured to associate the IPsec SA with the VRF according to the routing type RT and the Export RT.

[0121] Based on the seventh aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0122] Based on the seventh aspect, in a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0123] Based on the seventh aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

[0124] Based on the seventh aspect, in a possible implementation, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0125] Based on the seventh aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0126] Based on the seventh aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0127] The various functional modules in the seventh aspect are used to implement the method described in the third aspect and any possible implementation method of the third aspect.

[0128] In an eighth aspect, the present application provides a device for negotiating an Internet Protocol Security Association (IPsec) SA, the device being applied to a second site edge in a wide area network, the device comprising:

[0129] a processing module, configured to generate a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type (RT), the IPsec SA, an identifier of the second site edge, and an export route target (ExportRT), wherein the route type (RT) indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on service packets in a virtual routing forwarding (VRF) matching the Export RT;

[0130] The sending module is used to notify the BGP route to the first site edge.

[0131] Based on the eighth aspect, in a possible implementation, the BGP route is a BGP software-defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0132] Based on the eighth aspect, in a possible implementation manner, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

[0133] Based on the eighth aspect, in a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and / or an identifier of the second site edge.

[0134] Based on the eighth aspect, in a possible implementation, the BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

[0135] Based on the eighth aspect, in a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0136] Based on the eighth aspect, in a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0137] The various functional modules in the eighth aspect are used to implement the method described in the fourth aspect and any possible implementation method of the fourth aspect.

[0138] In a ninth aspect, the present application provides a network device comprising a memory and a processor, the memory being used to store instructions, and the processor being used to execute the instructions stored in the memory to implement the method described in the first aspect and any possible implementation of the first aspect, or to implement the method described in the second aspect and any possible implementation of the second aspect, or to implement the method described in the third aspect and any possible implementation of the third aspect, or to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0139] In the tenth aspect, the present application provides a system including a first site exit device edge and a second site edge, wherein the first site edge is used to execute the method described in the first aspect and any possible implementation of the first aspect, and the second site edge is used to execute the method described in the second aspect and any possible implementation of the second aspect; or, the first site edge is used to execute the method described in the third aspect and any possible implementation of the third aspect, and the second site edge is used to execute the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0140] In the eleventh aspect, the present application provides a computer storage medium, characterized in that it includes program instructions, which, when executed on a processor, enable the processor to implement the method described in the first aspect and any possible implementation of the first aspect, or enable the processor to implement the method described in the second aspect and any possible implementation of the second aspect, or enable the processor to implement the method described in the third aspect and any possible implementation of the third aspect, or enable the processor to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.

[0141] In the twelfth aspect, the present application provides a computer program product comprising program instructions. When the program instructions are executed on a processor, the processor implements the method described in the first aspect and any possible implementation of the first aspect, or the processor implements the method described in the second aspect and any possible implementation of the second aspect, or the processor implements the method described in the third aspect and any possible implementation of the third aspect, or the processor implements the method described in the fourth aspect and any possible implementation of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0142] FIG1 is a schematic diagram of a scenario provided by this application;

[0143] FIG2 is a flow chart of a method for negotiating an IPsec SA provided by the present application;

[0144] FIG3 is a schematic diagram of a partial structure of a BGPSD-WAN routing message provided by the present application;

[0145] FIG4 is a schematic diagram of a partial structure of a BGP EVPN routing message provided by the present application;

[0146] FIG5 is a flow chart of a method for securely transmitting messages provided by the present application;

[0147] FIG6A is a schematic diagram of the structure of a VPN service message provided by this application;

[0148] FIG6B is a schematic diagram of the structure of the first message provided by this application;

[0149] FIG6C is a schematic diagram of the structure of the second message provided by this application;

[0150] FIG7 is a schematic diagram of the structure of a second message provided by the present application;

[0151] FIG8 is a schematic diagram of the structure of another second message provided by the present application;

[0152] FIG9 is a flow chart of a method for securely transmitting messages provided by the present application;

[0153] FIG10 is a schematic structural diagram of a device for securely transmitting messages provided by the present application;

[0154] FIG11 is a schematic structural diagram of another apparatus for securely transmitting messages provided by the present application;

[0155] FIG12 is a schematic diagram of the structure of a network device provided in this application. DETAILED DESCRIPTION

[0156] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application.

[0157] Refer to Figure 1, which is a schematic diagram of a scenario provided by the present application. In the software-defined wide-area network (SD-WAN) shown in Figure 1, an SD-WAN tunnel is established between the points of presence (POPs) in the underlay network, a tunnel 1 is established between the customer premises equipment (CPE) 1 and the edge point of presence (EPOP) 1, a tunnel 2 is established between EPOP1 and the backbone point of presence (BPOP) 1, a tunnel 3 is established between BPOP1 and BPOP2, a tunnel 4 is established between BPOP2 and EPOP2, and a tunnel 5 is established between EPOP2 and CPE2, wherein CPE1 is located at site 1 and CPE2 is located at site 2. The ingress and egress nodes of each tunnel perform key negotiation based on TNP granularity.

[0158] In one application scenario, based on actual business needs, a business flow (business message) needs to flow from CPE1 to CPE2. That is, the business message needs to be transmitted from CPE1 to CPE2 across multiple tunnels. First, CPE1 encrypts the business message according to the key agreed upon between CPE1 and EPOP1 on tunnel 1. When the business message is transmitted to EPOP1, EPOP1 decrypts the message according to the agreed key. When the business message reaches tunnel 2, EPOP1 encrypts the business message according to the key agreed upon between EPOP1 and BPOP1 on tunnel 2. When the business message is transmitted to BPOP1, BPOP1 decrypts the business message according to the agreed key. ...until the message is transmitted to tunnel 5, EPOP2 encrypts the business message according to the key agreed upon between EPOP2 and CPE2 on tunnel 5. When the business message is transmitted to CPE2, CPE2 decrypts the business message according to the agreed key, parses the message, and obtains the data.

[0159] For this application scenario that requires transmission across multiple tunnels, multiple encryption and decryption steps are required, which is cumbersome, consumes computing resources of network devices, and increases the forwarding delay of business messages.

[0160] The present application provides a method for negotiating an Internet Protocol security (IPsec) security association (SA), which is applied to a wide area network. An IPsec SA is a security protocol used to provide confidentiality, integrity, and authentication of data on an IP network. An IPsec SA is a set of security parameters established between two network devices to protect the transmission of IP data packets. It includes encryption algorithms, authentication protocols, key lengths, key management, and other security parameters. Before an IPsec SA is established, the two devices must negotiate the security parameters to ensure they use the same security parameters. Once the IPsec SA is established, data packets are encrypted and authenticated using these security parameters to ensure confidentiality and integrity of the data.

[0161] Referring to FIG. 2 , FIG. 2 is a flow chart of a method for negotiating an IPsec SA provided in the present application, wherein the method includes but is not limited to the following description.

[0162] S101. An egress device edge at a second site in a wide area network generates a BGP route. The BGP route includes a route type RT, an IPsec SA, an identifier of the edge at the second site, and an export route target ExportRT.

[0163] A BGP route includes a route distinguisher (RD) and an export route target (RT). The RD identifies the virtual routing forwarding (VRF) of the second site edge, and the export route target (RT) matches the VRF of the second site edge.

[0164] The BGP route also includes the identifier of the edge of the second site. In one implementation, the identifier of the edge of the second site includes the site identifier site ID to which the second site edge belongs and the node identifier Node ID of the edge of the second site, that is, the edge can be determined by the site identifier and the node identifier. In another implementation, the node identifier in the wide area network is globally unique. In this case, the identifier of the edge of the second site may only include the node identifier, that is, the edge can be uniquely determined by the node identifier. In another implementation, the identifier of the edge of the second site may be the second site identifier site ID. In this case, any edge in the first site receives the BGP route announced by any edge in the second site, wherein the BGP route carries the identifier of the second site and the IPsec SA, which means that the key negotiated between the first site and the second site is the IPsec SA. Subsequently, any edge in the first site and any edge in the second site can securely protect and transmit service packets through the negotiated key IPsec SA.

[0165] A BGP route also includes a route type (RT) and an IPsec SA. The RT indicates that the IPsec SA advertised in the BGP route is used to provide end-to-end security protection for service packets in the virtual routing forwarding (VRF) that matches the export route target (Export RT). For example, if the VRF that matches the export route target (Export RT) is the VRF of the first site's edge, the RT indicates that the IPsec SA advertised in the BGP route is used to provide end-to-end security protection for service packets between the second site's edge and the first site's edge.

[0166] Optionally, the BGP route can be a BGP SD-WAN route, the sub-address family of which is the SD-WAN sub-address family, or a BGP Ethernet virtual private network (EVPN) route, the sub-address family of which is the EVPN sub-address family. The BGP route can also be other routes, and its sub-address family can be other sub-address families, which is not limited in this application.

[0167] BGP routing includes network layer reachability information (NLRI), in which the routing type RT, routing distinguisher RD and the identifier of the second site edge are all located in the NLRI. For example, see Figure 3, which is a partial structural diagram of a BGP SD-WAN routing provided by this application. In Figure 3, Route Type represents the routing type RT, which can be 2 bytes in length. In the SD-WAN sub-address family, the routing type can be defined as 2. Route Distinguisher represents the routing distinguisher RD, which can be 8 bytes in length. SD-WAN-Color is used to represent the site identifier, which can be 4 bytes in length. SD-WAN-Node-ID is used to represent the node identifier, which can be 4 bytes or 16 bytes in length. For another example, see Figure 4, which is a partial structural diagram of a BGP EVPN routing provided by this application. In Figure 4, the meaning of each field is the same as that of the each field in the schematic diagram of Figure 3, except that in the EVPN sub-address family, the routing type RT is defined as 10. It should be noted that defining the route type RT as 2 here is only an example in the SD-WAN sub-address family. Other numerical values ​​can be used in the SD-WAN address family to represent the newly added route type. Defining the route type RT as 10 is only an example of the EVPN sub-address family. Other numerical values ​​can be used in the EVPN address family to represent the newly added route type. This application does not make specific limitations.

[0168] BGP routes also include type-length-value (TLV for short). Specifically, BGP routes include Tunnel Encapsulation Attribute (TEA) TLV, wherein the TEA TLV includes IPsec SA, that is, the IPsec SA is carried in the TEA TLV field of the BGP route. Specifically, the IPsec SA is carried in the sub-TLV of the TEA TLV. BGP routes also include extended community attribute TLV, and the extended community attribute TLV includes the export route target Export RT, that is, the Export RT is carried in the extended community attribute TLV field of the BGP route. It should be noted that the positions of the IPsec SA and Export RT here are examples. The IPsec SA and Export RT can also be carried in other TLV fields of the BGP route, and this application does not make specific limitations.

[0169] For example, in the wide area network scenario diagram shown in FIG1 , the second site edge may be CPE1 or CPE2.

[0170] S102. The second site edge announces the BGP route to the first site edge.

[0171] The second-site edge advertises BGP routes in the WAN. For example, in the WAN shown in Figure 1, assuming the second-site edge is CPE1, after CPE1 generates a BGP route, it can reflect the BGP route to EPOP1 through the regional route reflector (RR). EPOP1 then reflects the BGP route to BPOP1, BPOP2, and EPOP2 through the managed service provider (MSP) RR. EPOP2 then reflects the BGP route to CPE2 through the regional RR, thus implementing the BGP route advertisement.

[0172] The first site edge in the WAN receives the BGP route advertised by the second site edge. For example, in Figure 1, if the second site edge is CPE1, the first site edge can be CPE2; if the second site edge is CPE2, the first site edge can be CPE1.

[0173] S103: Based on the routing type RT and Export RT, the first site edge associates the IPsec SA with the VRF.

[0174] The first-site edge receives the BGP route announced by the second-site edge, and associates the IPsec SA with the VRF based on the route type RT and the export route target Export RT in the BGP route. Specifically, Export RT is used to match the VRF of the second-site edge, and the route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF that matches the Export RT. Therefore, after receiving the BGP route, the first-site edge first determines whether the VRF of its own site matches the Export RT. If they match, the first-site edge associates the IPsec SA with the VRF of the first-site edge. Because the IPsec SA is also associated with the second-site edge, it can be understood that the VRF of the first-site edge and the VRF of the second-site edge are both associated with the IPsec SA. If they do not match, the first-site edge is not associated with the IPsec SA.

[0175] In one implementation, the matching strategy can be set as follows. An import route target and an export route target Export RT can be set in each edge in the wide area network, wherein the import route target is stored locally in the edge, and the export route target is carried in the BGP route. The BGP route sent by the second site edge carries the export route target. After the first site edge receives the BGP route sent by the second site, it compares the export route target in the BGP route with the import route target stored locally in the first site edge. If the two are consistent, the VRF of the first site edge matches the Export RT in the BGP route, and the first site edge associates the IPsec SA in the BGP route with the VRF of the first site edge. If the two are inconsistent, the VRF of the first site edge does not match the Export RT in the BGP route, and the IPsec SA is not associated with the VRF of the first site edge. For example, the Export RT carried in the BGP route sent by the second-site edge is 100, and the local import route target of the first-site edge is 100. After receiving the BGP route, the first-site edge compares the Export RT with the local import route target. After comparison, if the two are consistent, the first-site edge associates the IPsec SA carried in the BGP route with the VRF of the first-site edge. This is only one possible implementation method of the matching strategy. The matching strategy can also be implemented in other ways, which is not limited in this application.

[0176] The method described in this application can be applied to a wide area network, such as a software-defined wide area network (SD-WAN), where the first site edge and the second site edge can be site edges in the SD-WAN. The method described in this application can also be applied to other wide area networks, which is not limited in this application.

[0177] In actual applications, the first site edge and the second site edge can be determined according to actual business needs and business flows. The import routing target and export routing target of the first site edge, as well as the import routing target and export routing target of the second site edge can be set according to actual business needs.

[0178] It can be understood that after the BGP routing announcement, the VRF of the edge of the first site and the VRF of the edge of the second site are associated with the IPsec SA, that is, the IPsec SA used to transmit business messages has been negotiated between the edge of the first site and the edge of the second site. Then, when the business messages are subsequently transmitted between the edge of the first site and the edge of the second site, the business messages can be securely protected based on the negotiated IPsec SA, and the VPN business messages can be transmitted through the virtual routing forwarding VRF, thereby realizing end-to-end tunnel transmission between the edge of the first site and the edge of the second site, which only requires one security protection and one decapsulation process, thereby reducing transmission delay.

[0179] It can be seen that the present application provides a method for negotiating IPsec SA, adding a new route type in BGP routing, and carrying IPsec SA and export route targets in BGP routing. The newly added route type is used to indicate that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF that matches the export target route. The newly added route type implements IPsec SA negotiation based on VRF granularity. Through the announcement of BGP routing, an IPsec SA method is negotiated between the edge of the first site and the edge of the second site, so that when service packets are subsequently transmitted between the edge of the first site and the edge of the second site, the service packets can be securely protected based on the negotiated IPsec SA method, and VPN service packets can be transmitted by means of virtual routing forwarding VRF.

[0180] Based on the above-mentioned method for negotiating an IPsec SA, this application also provides a method for securely transmitting messages. Referring to Figure 5 , Figure 5 is a flow chart illustrating a method for securely transmitting messages provided by this application. The method is applied to a wide area network and includes, but is not limited to, the following description.

[0181] S201. A first site egress device edge in a wide area network receives a virtual private network VPN service message in a virtual routing forwarding (VRF).

[0182] The first site egress device edge in the wide area network receives the VPN service message in the VRF, wherein the VPN service message may be sent to the first site edge by the controller or sent to the first site edge by other network devices in the wide area network.

[0183] In the scenario diagram shown in FIG1 , the first site edge may be CPE1 or CPE2.

[0184] S202. The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message.

[0185] Through BGP routing advertisements, an IPsecSA is negotiated between the edge at the first site and the edge at the second site. Both the VRFs of the edge at the first site and the VRFs of the edge at the second site are associated with the IPsecSA. The IPsecSA provides end-to-end protection for service packets between the VRFs of the edge at the first site and the VRFs of the edge at the second site. Based on this, after the edge at the first site receives a VPN service packet in the VRF, it securely protects the VPN service packet based on the IPsecSA associated with the VRF negotiated with the edge at the second site, thus obtaining the first packet.

[0186] In one implementation, protecting VPN service messages includes encrypting the VPN service messages using the Encapsulate Security Payload (ESP) protocol. In another implementation, protecting VPN service messages includes encapsulating an Authentication Header (AH) in the VPN service messages. In another implementation, protecting VPN service messages includes encrypting the VPN service messages using the ESP protocol and encapsulating the VPN service messages using the Authentication Header (AH). Protecting VPN service messages may also be implemented using other methods, which are not limited in this application.

[0187] S203: The first site edge encapsulates tunnel information of an upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message.

[0188] The first site edge encapsulates the tunnel information of the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message. Among them, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple tunnel segments. For example, in the scenario diagram shown in Figure 1, if the first site edge is CPE1 and the second site edge is CPE2, then the underlying underlay tunnel corresponding to the overlay end-to-end tunnel between the first site edge and the second site edge includes tunnel 1 (CPE1 to EPOP1), tunnel 2 (EPOP1 to BPOP1), tunnel 3 (BPOP1 to BPOP2), tunnel 4 (BPOP2 to EPOP2) and tunnel 5 (EPOP2 to CPE2).

[0189] The overlay end-to-end tunnel includes at least one entry point POP, and the tunnel information includes information about at least one entry point. In one example, the overlay end-to-end tunnel includes a entry point POP, which is referred to as the first entry point POP for ease of description, wherein the first site edge is the entry point of the overlay end-to-end tunnel, and the second site edge is the exit point of the overlay end-to-end tunnel. The overlay end-to-end tunnel passes through the first entry point POP, which can be either an EPOP or a BPOP, and is not limited in this application. The tunnel information of the overlay end-to-end tunnel includes the first information of the first entry point.

[0190] In another example, the overlay end-to-end tunnel includes multiple entry points POPs, and the multiple entry points POPs include a first entry point POP and a second entry point POP, wherein the first site edge is the entry point of the overlay end-to-end tunnel, the second site edge is the exit point of the overlay end-to-end tunnel, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP. For example, in the scenario diagram shown in Figure 1, if the first site edge is CPE1 and the second site edge is CPE2, then the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple entry points, the first site edge accesses the WAN through EPOP1, and the second site edge accesses the WAN through EPOP2, then EPOP1 is the first POP, and EPOP2 is the second POP. The tunnel information of the overlay end-to-end tunnel includes first information of the first entry point and second information of the second entry point.

[0191] In one implementation, the overlay end-to-end tunnel is an Internet Protocol version 6 (IPv6) segment routing (SRv6) tunnel. The first site edge encapsulates tunnel information of the SRv6 tunnel outside the first message to obtain a second message. The second message includes an IPv6 header and a segment routing header (SRH). When the overlay end-to-end tunnel includes a first point of presence (PAP) and a second point of presence (PAP), the destination address of the IPv6 header points to the first PAP, and the SRH includes the first information and the second information.

[0192] For example, refer to Figures 6A to 6C, which are example diagrams provided by the present application. Figure 6A shows a VPN service message, including a message header Inner IP Hdr and a load Inner Payload. Figure 6B shows a first message, which is obtained after the VPN service message is encrypted by the ESP protocol. Figure 6C shows a second message, which is obtained after the tunnel information of the SRv6 tunnel between the first site edge and the second site edge is encapsulated outside the first message, wherein IPv6 Hdr (Src IP, Dst IP) represents the IPv6 message header, SRH (…, vpnsid) represents the segment routing header SRH, and the IPv6 message header and SRH constitute part of the tunnel information of the overlay end-to-end tunnel.

[0193] For another example, in the scenario diagram shown in Figure 1, assuming that CPE1 is the edge of the first site, CPE2 is the edge of the second site, and the overlay end-to-end tunnel between CPE1 and CPE2 is an SRv6 tunnel, CPE1 encapsulates the tunnel information of the SRv6 tunnel between CPE1 and CPE2 outside the first message to obtain a second message. As shown in Figure 7, Figure 7 is a schematic diagram provided by the present application. At CPE1, in the second message, IPv6 Hdr (cpe1, epop1-sid) is the IPv6 message header, and SRH (vpnsid, epop2-sid, bpop2-sid, bpop1-sid, epop1-sid) is the segment routing header SRH, where epop1-sid represents the first endpoint segment identifier END.SID of CPE1, bpop1-sid represents the first endpoint segment identifier END.SID of BPOP1, bpop2-sid represents the first endpoint segment identifier END.SID of BPOP2, and epop2-sid represents the first endpoint segment identifier END.SID of EPOP2. vpnsid is generated by CPE2 during BGP route announcement, and vpnsid is associated with the VRF of CPE2. EPOP1 is the first point of presence (POP), EPOP1's first endpoint segment identifier (epop1-sid) is the first information of the first point of presence (POP), EPOP2 is the second point of presence (POP), EPOP2's first endpoint segment identifier (epop2-sid) is the second information of the second point of presence (POP), and the operations associated with EPOP1's first endpoint segment identifier (epop1-sid) include matching the upper-layer overlying SRv6 policy from the first POP to the second POP based on the next-hop SID of epop1-sid. The operations associated with the segment identifier END.SID can be seen from the messages at each POP shown in Figure 7.

[0194] The upper-layer overlay network is built on the underlying underlay network. When the second message is transmitted through the overlay end-to-end tunnel, it is actually transmitted on the underlying underlay network. However, the upper-layer overlay network is unaware of how the message is transmitted in the underlying underlay network. Therefore, the underlay tunnel information must be encapsulated on the outer layer of the second message. The message encapsulated with the underlay tunnel information is then transmitted through the overlay end-to-end tunnel (the message actually encapsulated with the underlay tunnel information is transmitted on the underlying underlay tunnel). For example, in the scenario shown in Figure 1, because the wide area network is an SD-WAN, the message needs to traverse the carrier network during transmission. The devices in the carrier network cannot recognize the upper-layer overlying IPv6 address. Therefore, the underlay IP address of the underlying underlay tunnel is encapsulated on the outer layer.

[0195] In one implementation, the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engine (SR-MPLS TE) policy, and the second message includes an MPLS label stack, and the MPLS label stack includes first information of the first POP and second information of the second POP. The first information is the first node SID of the first POP, and the operation of associating the first node SID includes: matching the upper layer overlay SR MPLS tunnel between the first POP and the second POP according to the next hop SID of the first node SID in the label stack.

[0196] For example, in the scenario diagram shown in Figure 1, assuming that CPE1 is the edge of the first site, CPE2 is the edge of the second site, and the overlay end-to-end tunnel between CPE1 and CPE2 is an SR-MPLS TE Policy, CPE1 encapsulates the SR-MPLS TE Policy information between CPE1 and CPE2 outside the first message to obtain a second message. See Figure 8, which is a schematic diagram provided by the present application. At CPE1, in the second message, (epop1-sid, bpop1-sid, bpop2-sid, epop2-sid, cpe2-sid) represents the tunnel information of the overlay end-to-end tunnel, that is, the MPLS label stack, where epop1-sid represents the first node SID of EPOP1, bpop1-sid represents the first node SID of BPOP1, bpop2-sid represents the first node SID of BPOP2, epop2-sid represents the first node SID of EPOP2, and cpe2-sid represents the first node SID of CPE2. EPOP1 is the first access point (POP), and the first node segment identifier (epop1-sid) of EPOP1 is the first information of the first access point (POP). EPOP2 is the second access point (POP), and the first node segment identifier (epop2-sid) of EPOP2 is the second information of the second access point (POP). The operations associated with the first node SID include matching the upper-layer overly SR MPLS tunnel between the first POP and the second POP based on the next-hop SID of the first node SID in the label stack. The operations associated with the node segment identifier (SID) can be seen from the messages at each POP shown in Figure 8. The underlay IP in the message in Figure 8 is the tunnel information of the underlay tunnel.

[0197] In another implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second message can be tunnel encapsulated based on the Generic Network Virtualization Encapsulation (GENEVE) protocol, and the second message is encapsulated using SRv6 in GENEVE. Exemplarily, the second message includes: an outer IP header, a User Datagram Protocol (UDP) header, a GENEVE encapsulation, an SRH, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message; the GENEVE encapsulation includes a VPN identifier of the VPN service carried by the VPN service message. In one example, a metadata field may also be included between the SRH and the ESP to carry service intent information. Of course, the second message can also use SRv6 over GENEVE encapsulation. The difference between SRv6 over GENEVE encapsulation and SRv6 in GENEVE encapsulation is that an IPv6 header is included between the GENEVE encapsulation and the SRH. The encapsulation overhead of SRv6 over GENEVE encapsulation is larger than that of SRv6 in GENEVE encapsulation, but SRv6 over GENEVE encapsulation complies with the standard encapsulation format of SRv6.

[0198] In another implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the generic routing encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE. In one example, the second message includes: an outer IP header, a UDP header, an outer GRE encapsulation, an IPv6 header, an SRH, an inner GRE encapsulation, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message; the inner GRE encapsulation includes the VPN identifier of the VPN service carried by the VPN service message. The VPN identifier is carried in the inner GRE encapsulation. When the second message is transmitted in the network, the intermediate nodes passed by the overlay end-to-end tunnel do not resolve the VPN identifier (VPN identifier, VNI), that is, the intermediate nodes are not aware of the VPN. In one example, a metadata field may also be included between the SRH and the inner GRE encapsulation to carry service intent information.

[0199] The service intent information in the embodiments of the present application may include one or more information indicating the service intent. In one example, the service intent information may include quality of service parameters, including but not limited to one or more parameters such as latency, packet loss, jitter, bandwidth utilization, and bit error rate. In another example, the service intent parameters may include gateway constraint information that must be satisfied by the end-to-end path from site edge1 to site edge2, including but not limited to gateways that must be passed through and / or gateways that must be bypassed.

[0200] S204. The first site edge sends a second message to the second site edge through the overlay end-to-end tunnel.

[0201] The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel. In a possible implementation, the first site edge sends the second message to the second site edge through the SRv6 tunnel or SR-MPLS TE Policy.

[0202] It should be noted that the POPs between the first and second site edges are unaware of the second message and do not decrypt it. Instead, they forward it according to the tunnel information of the overlay end-to-end tunnel until it reaches the second site edge. Therefore, during transmission, service messages only require security protection once at the first site edge; decryption is not required at other POPs, reducing computing resource consumption, improving forwarding efficiency, and reducing transmission latency.

[0203] The method for securely transmitting messages provided in this embodiment can be applied to SD-WAN. The first site edge and the second site edge are site edges in the SD-WAN. The method can also be applied to other wide area networks, which is not limited in this application.

[0204] The present application scheme adds a new route type RT to BGP routing. The BGP routing carries IPsec SA and export routing target ExportRT. The newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT. By announcing the BGP routing in the wide area network, end-to-end IPsec SA negotiation based on VRF granularity is achieved between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages. Compared with the existing IPsec SA negotiation based on TNP granularity, each access point POP between the first site edge and the second site edge is not aware of the inner VPN service message. Through the end-to-end encryption and decryption between the two site edges, the consumption of computing resources is reduced, the forwarding efficiency is improved, and the transmission delay is reduced.

[0205] Based on the above-mentioned IPsecSA negotiation method and secure message transmission method, the present application also provides a secure message transmission method. Referring to FIG9 , FIG9 is a flow chart of a secure message transmission method provided by the present application, which includes but is not limited to the following description.

[0206] S301. The second site edge in the wide area network receives a second message sent by the first site edge through the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge. The second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in the outer layer of the first message.

[0207] In the present embodiment, the method for securely transmitting messages can be applied to SD-WAN, where the first site edge and the second site edge are site edges in the SD-WAN. The method can also be applied to other wide area networks, which is not limited in this application.

[0208] The second site egress device edge receives the second message sent by the first site edge through the upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge. The underlying underlay tunnel corresponding to the upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge includes multiple tunnel segments. For example, referring to the scenario diagram shown in FIG1 , the first site edge may be CPE1, and the second site edge may be CPE2; or, the first site edge may be CPE2, and the second site edge may be CPE1. The underlying underlay tunnel corresponding to the overlay end-to-end tunnel established between CPE1 and CPE2 includes multiple tunnel segments, specifically including: tunnel 1 (CPE1 to EPOP1), tunnel 2 (EPOP1 to BPOP1), tunnel 3 (BPOP1 to BPOP2), tunnel 4 (BPOP2 to EPOP2), and tunnel 5 (EPOP2 to CPE2).

[0209] The overlay end-to-end tunnel includes at least one access point POP, and the tunnel information includes information about at least one access point. In one example, the overlay end-to-end tunnel includes a first access point POP, and the tunnel information includes first information about the first access point. In another example, the overlay end-to-end tunnel includes multiple access points POPs, and the multiple access points POPs include a first access point POP and a second access point POP, and the tunnel information includes first information about the first access point and second information about the second access point. The first site edge is the entry point of the overlay end-to-end tunnel, and the second site edge is the exit point of the overlay end-to-end tunnel. The first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.

[0210] In one implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second site edge receives the second message sent by the first site edge through the SRv6 tunnel. The second message includes the first message and the tunnel information of the SRv6 tunnel encapsulated in the outer layer of the first message. The first message is a message obtained by performing security protection on the VPN service message through the IPsecSA negotiated by the second site edge and the first site edge. The tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH. The destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information. Regarding the formats of the service message, the first message, and the second message, please refer to the schematic diagrams shown in Figures 6A to 6C. For the sake of brevity of the specification, they will not be repeated here.

[0211] In one implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy, and the second message includes the first message and the SR-MPLS TE Policy information encapsulated within the first message. The SR-MPLS TE Policy information includes an MPLS label stack, which includes first information about the first point of view (POP) and second information about the second point of view (POP). The format of the second message can be found in the description of the above method embodiment and will not be detailed here for the sake of brevity.

[0212] In a possible implementation, the second message may also include a header for the underlying underlay tunnel. For example, in the SD-WAN scenario shown in Figure 1, since the message needs to traverse the carrier network during transmission, the devices in the carrier network cannot recognize the upper-layer overlying IPv6 address. Therefore, an underlay tunnel header (underlay IP) is encapsulated in the outer layer.

[0213] S302. The second site edge decapsulates the second message to obtain the first message.

[0214] The second site edge decapsulates the second message to obtain the first message. In one implementation, the overlay end-to-end tunnel is an SRv6 tunnel, and the second message includes the first message and tunnel information of the SRv6 tunnel. The second site edge decapsulates the second message, removes the tunnel information of the SRv6 tunnel, and obtains the first message. A schematic diagram of the first message format is shown in Figure 6B and is not further described here.

[0215] In one implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy. The second message includes the first message and the SR-MPLS TE Policy information encapsulated in the outer layer of the first message. The second site edge decapsulates the second message, removes the tunnel information of the MPLS SR-TE tunnel, and obtains the first message. A schematic diagram of the first message format is shown in Figure 6B and is not further described here.

[0216] In one implementation, the overlay end-to-end tunnel is a GENEVE-encapsulated tunnel, and the second message is encapsulated using SRv6 in GENEVE. The second site edge then decapsulates the second message, removes the SRv6 in GENEVE encapsulated message header, and obtains the first message. A schematic diagram of the first message format is shown in FIG6B and is not further described here.

[0217] In another implementation, the overlay end-to-end tunnel is a tunnel based on the GRE protocol encapsulation, and the second message is encapsulated using SRv6 over GRE. The second site edge then decapsulates the second message, removes the SRv6 over GRE encapsulated message header, and obtains the first message. A schematic diagram of the first message format is shown in Figure 6B and is not further described here.

[0218] S303: The second site edge processes the first message according to the IPsecSA to obtain a virtual private network VPN service message.

[0219] In one implementation, the second site edge performs ESP processing on the first message based on the IPsecSA to obtain a VPN service message. In another implementation, the second site edge authenticates the first message based on the IPsecSA and the authentication data carried in the authentication header (AH) of the first message to obtain a VPN service message. In another implementation, the second site edge performs ESP decryption on the first message based on the IPsecSA and authenticates the first message based on the IPsecSA and the authentication data carried in the authentication header (AH) of the first message to obtain a VPN service message.

[0220] It should be noted that the first site edge can generate a BGP route and notify the second site edge of the BGP route, or the second site edge can generate a BGP route and notify the BGP route to the first site edge. Both methods can achieve the association of the VRF of the first site edge and the VRF of the second site edge with the IPsec SA. After the VRF of the first site edge and the VRF of the second site edge are associated with the IPsec SA in either of the two methods, the first site edge can perform security protection and encapsulation on the VPN service message based on the negotiated IPsec SA, and then send it to the second site edge. The second site edge will decapsulate and decrypt the VPN service message according to the negotiated IPsec SA to obtain the VPN service message.

[0221] It can be seen that the present application provides a method for securely transmitting messages. Through BGP routing announcements, an IPsec SA is negotiated between the edge of the first site and the edge of the second site, and the IPsec SA is associated with the VRF of the edge of the first site and the VRF of the edge of the second site. When transmitting VPN service messages across multiple tunnel scenarios, it is only necessary to perform security protection on the VPN service message at the edge of the first site according to the negotiated IPsec SA to obtain a first message, and then encapsulate the tunnel information of the overlay end-to-end tunnel established between the edge of the first site and the edge of the second site on the outside of the first message to obtain a second message, and then send the second message to the edge of the second site through the overlay end-to-end tunnel.

[0222] In a scenario where the entire transmission spans multiple underlay tunnels, IPsec SA security protection only needs to be performed once at the edge of the first site, and IPsec SA processing only needs to be performed once at the edge of the second site. Each access point in between does not need to encrypt or decrypt the message; it only needs to forward it according to the tunnel information. Therefore, the implementation of the embodiments of the present application reduces the consumption of computing resources of network nodes, improves forwarding efficiency, and reduces transmission latency.

[0223] The above is a description of the method embodiment provided in the present application. The following is an apparatus embodiment corresponding to the method embodiment provided in the present application.

[0224] Referring to FIG. 10 , FIG. 10 is a schematic structural diagram of an apparatus 600 for securely transmitting a message according to an embodiment of the present application. The apparatus 600 for securely transmitting a message can be configured as a first site edge in a wide area network. The apparatus 600 includes:

[0225] A receiving module 610 is configured to receive a virtual private network VPN service message in a virtual routing forwarding VRF;

[0226] The processing module 620 is configured to perform security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the edge of the second site to obtain a first message;

[0227] Processing module 620 is further configured to encapsulate, in an outer layer of the first message, tunnel information of an upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge, to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the first site edge is an ingress endpoint of the overlay end-to-end tunnel, the second site edge is an egress endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;

[0228] The sending module 630 is configured to send a second message to the second site edge through the overlay end-to-end tunnel.

[0229] In a possible implementation, the processing module 620 is configured to: perform Encapsulating Security Payload (ESP) protocol encryption on the VPN service message; and / or encapsulate an Authentication Header on the VPN service message.

[0230] In a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.

[0231] In a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

[0232] In a possible implementation, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overlay SRv6 Policy between the first POP and the second POP according to the next-hop SID of END.SID.

[0233] In a possible implementation, the overlay end-to-end tunnel is an SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0234] In a possible implementation, the first information is the first node SID of the first POP, and the operation of associating the first node SID includes: matching the upper layer overlay SR MPLS tunnel between the first POP and the second POP according to the next hop SID of the first node SID in the label stack.

[0235] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0236] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0237] In a possible implementation, the receiving module 610 is also used to receive the Border Gateway Protocol BGP route announced by the edge of the second site, where the BGP route includes a route type RT, an IPsec SA, an identifier of the edge of the second site, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for VPN service packets in the virtual routing forwarding VRF that matches the Export RT; the processing module 620 is used to associate the IPsec SA with the VRF based on the route type RT and the Export RT.

[0238] In a possible implementation, the BGP route is a BGP software-defined wide area network (SD-WAN) route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network (EVPN) route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0239] In a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0240] In a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes a route type RT and an identifier of the second site edge.

[0241] In a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute TLV (Type-Length-Value), and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.

[0242] In a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0243] In a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0244] The apparatus 600 for securely transmitting messages can be used to implement the method embodiment corresponding to FIG5 , i.e., the method embodiment corresponding to the sending side of the data forwarding plane, and can also be used to implement the method steps performed by the first site edge in the method embodiment of FIG2 , i.e., the method embodiment corresponding to the receiving side of the control plane. For details, please refer to the description of the specific contents of the method embodiment in FIG2 or FIG5 . For the sake of brevity of the specification, they will not be repeated here. When the apparatus 600 for securely transmitting messages is used to implement the method embodiment corresponding to the receiving side of the control plane, the apparatus 600 for securely transmitting messages can also be referred to as an apparatus for negotiating an IPsec SA.

[0245] It can be understood that the division of each functional module and the corresponding execution steps of each functional module in Figure 10 are only an example. In other embodiments, the device 600 can also be divided into more or fewer functional modules according to specific execution steps.

[0246] Referring to FIG. 11 , FIG. 11 is a schematic diagram of the structure of another apparatus 700 for securely transmitting messages provided in an embodiment of the present application. The apparatus 700 for securely transmitting messages can be configured as a second site edge in a wide area network. The apparatus 700 includes:

[0247] Receiving module 710 is configured to receive a second message sent by the first site edge through an upper-layer overlay end-to-end tunnel established between the first site edge and the second site edge, where the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnel segments, the tunnel information includes first information of a first point of presence (POP), the first site edge is an ingress endpoint of the overlay end-to-end tunnel, the second site edge is an egress endpoint of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network (VPN) service message through an Internet Protocol security (IPsec) SA negotiated between the second site edge and the first site edge;

[0248] The processing module 720 is configured to decapsulate the second message to obtain the first message;

[0249] The processing module 720 is configured to process the first message according to the IPsecSA to obtain a VPN service message.

[0250] In a possible implementation, the processing module 720 is configured to: perform Encapsulating Security Payload (ESP) protocol decryption on the first message according to the IPsec SA; and / or authenticate the first message according to the IPsec SA and authentication data carried in the Authentication Header of the first message.

[0251] In a possible implementation, the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.

[0252] In a possible implementation, the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes first information and second information.

[0253] In a possible implementation, the first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper-layer overlay SRv6 Policy between the first POP and the second POP according to the next-hop SID of END.SID.

[0254] In a possible implementation, the overlay end-to-end tunnel is a Segment Routing Multi-Protocol Label Switching Traffic Engineering Policy (SR-MPLS TE Policy), the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

[0255] In a possible implementation, the first information is the first node SID of the first POP, and the operation of associating the first node SID includes: matching the upper layer overlay SR MPLS tunnel between the first POP and the second POP according to the next hop SID of the first node SID in the label stack.

[0256] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

[0257] In a possible implementation, the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

[0258] In a possible implementation,

[0259] Processing module 720 is configured to generate a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type (RT), an IPsec SA, an identifier of the second site edge, and an export route target (ExportRT), wherein the route type (RT) indicates that the IPsec SA advertised in the BGP route is used to provide end-to-end security protection for VPN service packets in a virtual routing forwarding (VRF) matching the Export RT.

[0260] The sending module 730 is configured to notify the second site edge of the BGP route to the first site edge.

[0261] In a possible implementation, the BGP route is a BGP software-defined wide area network (SD-WAN) route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network (EVPN) route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

[0262] In a possible implementation, the identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and / or a node identifier Node ID of the second site edge.

[0263] In a possible implementation, the BGP route includes network layer reachability information NLRI, and the NLRI includes a route type RT and an identifier of the second site edge.

[0264] In a possible implementation, the BGP route includes a Tunnel Encapsulation Attribute TLV (Type-Length-Value), and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.

[0265] In a possible implementation, the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

[0266] In a possible implementation, the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

[0267] The device 700 for securely transmitting messages can be used to implement the method embodiment corresponding to FIG9 , that is, the method embodiment corresponding to the data forwarding plane receiving side, and can also be used to implement the method steps performed by the second site edge in the method embodiment corresponding to FIG2 , that is, the method embodiment corresponding to the control plane sending side. For details, please refer to the description of the specific contents of the method embodiment in FIG2 or FIG9 . For the sake of brevity of the specification, they will not be repeated here. When the device 700 for securely transmitting messages is used to implement the method embodiment corresponding to the control plane sending side, the device 700 for securely transmitting messages can also be called a device for negotiating IPsec SA.

[0268] It can be understood that the division of each functional module and the corresponding execution steps of each functional module in Figure 11 are only an example. In other embodiments, the device 700 can also be divided into more or fewer functional modules according to specific execution steps.

[0269] Referring to Figure 12, Figure 12 is a schematic diagram of the structure of a network device 800 provided in this application. The network device 800 can be configured as a first site edge in a wide area network, or as a second site edge in a wide area network. The network device 800 can be implemented using a general bus architecture.

[0270] The network device 800 includes at least one processor 801 , a memory 803 , and at least one communication interface 804 .

[0271] The processor 801 may be a general-purpose CPU, NP, microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0272] Network device 800 may also include a communication bus 802 for transmitting information between various components. Communication bus 802 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG12 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0273] The memory 803 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 803 may be independent and connected to the processor 801 via the communication bus 802; the memory 803 may also be integrated with the processor 801.

[0274] The communication interface 804 is used to communicate with other devices or communication networks. The communication interface 804 may include a wired communication interface or a wireless communication interface. The wired communication interface may be, for example, an Ethernet interface, which may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0275] In a specific implementation, as an embodiment, the processor 801 may include one or more CPUs, for example, CPU0 and CPU1 shown in FIG12 .

[0276] In a specific implementation, as an embodiment, the network device 800 may include multiple processors, such as processor 801 and processor 805 shown in FIG12 . Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0277] In some embodiments, the memory 803 is used to store the program code 810 of the present application solution, and the processor 801 is used to execute the program code 810 stored in the memory 803. That is, the network device 800 can implement the method provided in the method embodiment of Figure 2, Figure 5, or Figure 9 through the processor 801 and the program code 810 in the memory 803.

[0278] The network device 800 of the embodiment of the present application may correspond to the first site edge or the second site edge in each of the above-mentioned method embodiments. Furthermore, the processor 801, communication interface 804, etc. in the network device 800 may implement the functions and / or various steps and methods implemented by the devices in each of the above-mentioned method embodiments. For the sake of brevity, these details are not repeated here.

[0279] When the network device 800 is configured as the first site edge, corresponding to the above-mentioned device 600 for securely transmitting messages, the receiving module 610 and the sending module 630 in the device 600 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 620 can be located in the processor 801 or the processor 805 in the network device 800.

[0280] When the network device 800 is configured as the second site edge, corresponding to the above-mentioned device 700 for securely transmitting messages, the receiving module 710 and the sending module 730 in the device 700 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 720 can be located in the processor 801 or the processor 805 in the network device 800.

[0281] The various hardware, modules and other operations and / or functions in the network device 800 are respectively various steps and methods implemented by the device 600 for securely transmitting messages or the device 700 for securely transmitting messages. For detailed processes such as how the network device 800 implements message processing, please refer to the above-mentioned method embodiments for specific details. For the sake of brevity of the specification, they will not be repeated here.

[0282] Among them, each step of Figure 2 or Figure 5 or Figure 9 above is completed by the hardware integrated logic circuit or software instruction in the processor of the network device 800. The method and steps disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be completed by a combination of hardware and software modules (software units) in the processor. The software module can be located in one or more storage media mature in the art such as random access memory, flash read-only memory, programmable read-only memory, electrically erasable programmable memory and registers. The storage medium is located in the memory, and the processor reads the information in the memory and executes the steps in the above method in combination with the hardware. For the sake of brevity of the specification, it will not be described in detail here.

[0283] An embodiment of the present application also provides a system, which includes a first site edge and a second site edge. The first site edge can be the above-mentioned device 600 or network device 800 for secure message transmission, and the second site edge can be the above-mentioned device 700 or network device 800 for secure message transmission. The first site edge can be used to implement the method embodiment described in Figure 2 or Figure 5 above, and the second site edge can be used to implement the method embodiment described in Figure 2 or Figure 9 above. For details, please refer to the description of the method embodiment of Figure 2 or Figure 5 or Figure 9 above, which will not be repeated here.

[0284] An embodiment of the present application further provides a computer storage medium including program instructions. When the program instructions are executed on a processor, the processor implements the various steps in the method embodiments described in FIG. 2 , FIG. 5 , or FIG. 9 .

[0285] An embodiment of the present application further provides a computer program product comprising program instructions. When the program instructions are executed on a processor, the processor implements the various steps in the method embodiments described in FIG. 2 , FIG. 5 , or FIG. 9 .

[0286] Those skilled in the art will appreciate that the various method steps and units described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0287] Those skilled in the art will clearly understand that, for the sake of convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0288] In the several embodiments provided in this application, the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the unit is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0289] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0290] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0291] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0292] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer program instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions in accordance with the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD), or a semiconductor medium (e.g., a solid-state drive), etc.

[0293] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and such modifications or substitutions should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for securely transmitting a message, characterized in that: The method comprises: The first site egress device edge in the wide area network receives the virtual private network VPN service message in the virtual routing forwarding VRF; The first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message; The first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound endpoint of the overlay end-to-end tunnel, the second site edge is an outbound endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP; The first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.

2. The method according to claim 1, characterized in that The security protection of the VPN service message includes: Encrypting the VPN service message using the Encapsulation Security Payload (ESP) protocol; and / or, The VPN service message is encapsulated with an Authentication Header.

3. The method according to claim 1 or 2, characterized in that: The tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

4. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.

5. The method according to claim 4, characterized in that The first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy between the first POP and the second POP according to the next hop SID of the END.SID.

6. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

7. The method according to claim 6, characterized in that The first information is a first node SID of the first POP, and the operations associated with the first node SID include: An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

8. The method according to claim 3, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

9. The method according to claim 3, characterized in that: The overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

10. The method according to any one of claims 1 to 9, characterized in that: Before the first site edge receives the service message, the method further includes: The first site edge receives a Border Gateway Protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

11. The method according to claim 10, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

12. The method according to claim 10 or 11, characterized in that: The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

13. The method according to any one of claims 10 to 12, characterized in that: The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

14. The method according to any one of claims 10 to 13, characterized in that: The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

15. The method according to any one of claims 10 to 14, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

16. The method according to any one of claims 10 to 15, characterized in that: The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

17. A method for securely transmitting a message, characterized in that: The method comprises: A second site egress device edge in a wide area network receives a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance (IPsec) SA negotiated by the second site edge and the first site edge; the second site edge decapsulates the second message to obtain a first message; The second site edge processes the first message according to the IPsecSA to obtain the VPN service message.

18. The method according to claim 17, characterized in that The processing of the first message includes: According to the IPsecSA, decrypting the first message by the Encapsulating Security Payload (ESP) protocol; and / or, The first message is authenticated according to the IPsec SA and the authentication data carried in the Authentication Header of the first message.

19. The method according to claim 17 or 18, characterized in that The tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.

20. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6, the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.

21. The method according to claim 20, characterized in that The first information is the first endpoint segment identifier END.SID of the first POP, and the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy between the first POP and the second POP according to the next hop SID of the END.SID.

22. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy, the second message includes an MPLS label stack, and the MPLS label stack includes the first information and the second information.

23. The method according to claim 22, characterized in that The first information is a first node SID of the first POP, and the operations associated with the first node SID include: An upper layer overlay SR MPLS tunnel between the first POP and the second POP is matched according to the next hop SID of the first node SID in the label stack.

24. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.

25. The method according to claim 19, characterized in that The overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.

26. The method according to any one of claims 17 to 25, characterized in that Before the second site egress device edge in the wide area network receives the second message sent by the first site edge through the upper layer overlay end-to-end tunnel, the method further includes: The second site egress device edge generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual route forwarding VRF matching the Export RT; The second site edge announces the BGP route to the first site edge.

27. The method according to claim 26, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

28. The method according to claim 26 or 27, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

29. The method according to any one of claims 26 to 28, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

30. The method according to any one of claims 26 to 29, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

31. The method according to any one of claims 26 to 30, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

32. The method according to any one of claims 26 to 31, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

33. A method for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The method comprises: The first site egress device edge in the wide area network receives a border gateway protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT; According to the routing type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.

34. The method according to claim 33, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

35. The method according to claim 33 or 34, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

36. The method according to any one of claims 33 to 35, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

37. The method according to any one of claims 33 to 36, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

38. The method according to any one of claims 33 to 37, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

39. The method according to any one of claims 33 to 38, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

40. A method for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The method comprises: The second site egress device edge in the wide area network generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA advertised by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT; The second site edge announces the BGP route to the first site edge.

41. The method according to claim 40, characterized in that The BGP route is a BGP software defined wide area network SD-WAN route, and the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family, or the BGP route is a BGP Ethernet virtual private network EVPN route, and the sub-address family of the BGP EVPN route is the EVPN sub-address family.

42. The method according to claim 40 or 41, characterized in that The identifier of the second site edge includes a site identifier site ID to which the second site edge belongs and a node identifier Node ID of the second site edge.

43. The method according to any one of claims 40 to 42, characterized in that The BGP route includes network layer reachability information NLRI, and the NLRI includes the route type RT and an identifier of the second site edge.

44. The method according to any one of claims 40 to 43, characterized in that The BGP route includes a tunnel encapsulation attribute type-length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.

45. The method according to any one of claims 40 to 44, characterized in that The BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.

46. ​​The method according to any one of claims 40 to 45, characterized in that The first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.

47. A device for securely transmitting messages, characterized in that: The apparatus comprises a module for implementing the method according to any one of claims 1-16.

48. A device for securely transmitting messages, characterized in that: The apparatus comprises a module for implementing the method according to any one of claims 17-32.

49. A device for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The apparatus comprises a module for implementing the method as claimed in any one of claims 33-39.

50. A device for negotiating an Internet Protocol Security Alliance (IPsec SA), characterized in that: The apparatus comprises a module for implementing the method as claimed in any one of claims 40-46.

51. A network device, characterized in that: It includes a memory and a processor, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the method as described in any one of claims 1 to 16, or to implement the method as described in any one of claims 17 to 32, or to implement the method as described in any one of claims 33 to 39, or to implement the method as described in any one of claims 40 to 46.

52. A system, characterized in that: It includes a first site export device edge and a second site edge, the first site edge is used to execute the method as described in any one of claims 1 to 16, and the second site edge is used to execute the method as described in any one of claims 17 to 32; or, the first site edge is used to execute the method as described in any one of claims 33 to 39, and the second site edge is used to execute the method as described in any one of claims 40 to 46.

53. A computer storage medium, characterized in that Comprising program instructions, which, when executed on a processor, enable the processor to implement the method as described in any one of claims 1 to 16, or enable the processor to implement the method as described in any one of claims 17 to 32, or enable the processor to implement the method as described in any one of claims 33 to 39, or enable the processor to implement the method as described in any one of claims 40 to 46.

54. A computer program product comprising program instructions, characterized in that When the program instructions are executed on a processor, the processor implements the method as described in any one of claims 1 to 16, or the processor implements the method as described in any one of claims 17 to 32, or the processor implements the method as described in any one of claims 33 to 39, or the processor implements the method as described in any one of claims 40 to 46.

Images