Packet inspection method, electronic device, system, and computer-readable storage medium

Abstract

The present application relates to the technical field of communication security, and provides a packet inspection method, an electronic device, a system, and a computer-readable storage medium. In the present application, inspection mark information used for performing risk indication on a service packet is set in the service packet. In the process of forwarding the service packet in a forwarding path, a security device forwards the service packet carrying the inspection mark information, or performs security inspection on the service packet before forwarding and then updates the value of a field in the service packet on the basis of an inspection result. A network device sends flow security state information to a network management analyzer on the basis of the inspection mark information carried in the service packet. The present application can assist a control plane in identifying a service flow forwarding path having a risk.

Description

Message detection method, electronic device, system and computer-readable storage medium

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on August 29, 2023, with application number 202311098912.2 and application name “A business flow security detection method and related equipment”, and claims priority to the Chinese patent application filed with the State Intellectual Property Office on November 27, 2023, with application number 202311604185.2 and application name “Message detection method, electronic device, system and computer-readable storage medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication security technology, and in particular to a message detection method, electronic device, system and computer-readable storage medium. Background Art

[0003] Firewall technology is a technology that helps a computer network build a relatively isolated protective barrier between its internal and external networks, thereby protecting user data and information security.

[0004] Currently, when a firewall discovers that a computer network is under attack during operation, it will block some messages, such as discarding data packets (also known as "packet loss") to ensure the security of the computer network operation. However, network operation and maintenance personnel cannot know the cause of the traffic packet loss, nor can they know the threatening message forwarding path in the network, which affects business security.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a message detection method, electronic device, system and computer-readable storage medium, which help solve the problem that the network management analyzer cannot identify the risk message forwarding path in the business flow by setting detection mark information in the message to indicate risk.

[0007] To achieve the above objectives, this application adopts the following technical solutions:

[0008] In a first aspect, a message detection method is provided, the method comprising: a security device receiving a first service message from a previous-hop device on a service flow forwarding path, the message header of the first service message including detection tag information, the detection tag information including a first field, the value of the first field being used to indicate whether the first service message is at risk; the security device sending a second service message to a next-hop device on the service flow forwarding path, wherein the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

[0009] The solution provided in the first aspect above sets detection mark information in the business message and provides risk indication for the business message based on the detection mark information. In this way, the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the business message, thereby ensuring the security of the business.

[0010] As a possible implementation, if the value of the first field in the first service message is a second numerical value, and the second numerical value indicates that the first service message is at risk, the security device sends a second service message to the next-hop device on the service flow forwarding path, including: the security device sends the second service message to the next-hop device on the service flow forwarding path, where the first service message and the second service message are identical. In this way, when the value of the first field in the first service message indicates that the first service message is at risk, the second service message sent to the next-hop device is identical to the first service message, enabling the service message indicated as at risk to retain the risk tag during forwarding, thereby assisting the network management analyzer in identifying risky paths and ensuring service security.

[0011] For example, when the value of the first field in the first business message is the second value, if the security detection result of the security device on the first business message indicates that there is no risk in the first business message, the value of the first field in the detection mark information is not updated. In this way, the obtained second business message is the same as the first business message.

[0012] For example, when the value of the first field in the first business message is the second value, if the security detection result of the security device on the first business message indicates that there is a risk in the first business message, the value of the first field in the detection mark information is not updated. In this way, the obtained second business message is the same as the first business message.

[0013] As a possible implementation, if the value of the first field in the first service message is a first numerical value, the first numerical value indicating that the first service message is not risky, before the security device sends the second service message to the next-hop device on the service flow forwarding path, the method further includes: the security device performing a security check on the first service message; the security device sending the second service message to the next-hop device on the service flow forwarding path, including: in response to the security device's security check result on the first service message indicating that the first service message is not risky, the security device sending the second service message to the next-hop device on the service flow forwarding path, the first service message being identical to the second service message; in response to the security device's security check result on the first service message indicating that the first service message is risky, the security device sending the second service message to the next-hop device on the service flow forwarding path, the second service message being obtained by updating the value of the first field of the first service message to a second numerical value, the second numerical value indicating that the second service message is risky. In this way, identifying risky service messages in a service flow through security checks and indicating risky service messages based on detection tag information can assist a network management analyzer in identifying risky paths and ensuring service security.

[0014] The security device performs security detection on the first service message, including: detecting whether the flow identification information of the first service message is the same as the flow identification information of the third service message with risk that has been detected by the security device, and whether the first service message includes malicious features.

[0015] For example, if the flow identification information in the first service message is the same as the flow identification information of the third service message that the security device has detected as posing a risk, and / or the first service message includes malicious features, the security device's security detection result on the first service message indicates that the first service is at risk. If the flow identification information in the first service message is different from the flow identification information of the third service message that the security device has detected as posing a risk, and the first service message does not include malicious features, the security device's security detection result on the first service message indicates that the first service is not at risk.

[0016] Exemplarily, in response to the security device's security detection result on the first business message indicating that the first business message is at risk, the security device sends a second business message to the next-hop device on the business flow forwarding path, including: if the flow identification information of the first business message is the same as the flow identification information of the third business message that the security device has detected as at risk, but the first business message does not include malicious features, sending the second business message to the next-hop device on the business flow forwarding path.

[0017] As a possible implementation method, the detection tag information in the first service message also includes a second field, the value of the second field is used to indicate whether the first service message has been security detected, and the security device performs security detection on the first service message, including: in response to the value of the second field in the detection tag information in the first service message being a third value, the third value indicating that the first service message has not been security detected, the security device performs security detection on the first service message, and before the security device sends the second service message to the next hop device on the service flow forwarding path, the method also includes: updating the value of the second field of the first service message to a fourth value, the fourth value indicating that the first service message has been security detected, thereby obtaining the second service message. In this way, it is convenient for the security device to perform targeted processing on service messages, for example, focusing on performing security detection on messages that have not been security detected, reducing the number of service messages that the security device needs to perform security detection on, and helping the security device improve processing efficiency.

[0018] As a possible implementation, before the security device performs a security check on the first service message, the method further includes: in response to the value of the second field in the detection flag information in the first service message being a fourth value, the security device omitting the step of performing a security check on the first service message. This facilitates the security device to perform targeted processing on service messages, for example, omitting further security checks on messages that have already been security checked, thereby reducing the number of service messages that the security device needs to perform security checks on, and improving processing efficiency.

[0019] As a possible implementation method, the security device performs a security detection on the first business message, including: the security device determines whether the flow identification information of the first business message is the same as the flow identification information of the third business message that the security device has detected as having a risk; in response to the flow identification information of the first business message being the same as the flow identification information of the third business message that the security device has detected as having a risk, the security device determines that the security detection result of the first business message indicates that the first business message is at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that the security device has detected as having a risk, the security device determines that the first business message is at risk. Whether the service message includes malicious features in the malicious feature library; in response to the flow identification information of the first service message being different from the flow identification information of the third service message that has been detected by the security device as posing a risk, and the first service message not including the malicious features in the malicious feature library, determining that the security detection result of the first service message indicates that the first service message does not pose a risk; in response to the flow identification information of the first service message being different from the flow identification information of the third service message that has been detected by the security device as posing a risk, and the first service message including the malicious features in the malicious feature library, determining that the security detection result of the first service message indicates that the first service message poses a risk. In this way, by matching the flow identification information of the first service message with the flow identification information of the third service message that poses a risk, and performing content security detection on the first service message, security detection of the first service message is achieved from multiple dimensions, which can improve the security of the network, and through security detection from multiple dimensions, risky service messages that pose potential threats can be identified, and then the network management analyzer can be assisted in identifying the attacked service flow forwarding path based on the service messages that pose potential threats.

[0020] Exemplarily, the flow identification information includes one or more of the following: address information of the source end, address information of the destination end, port number of the source end, port number of the destination end, and protocol type.

[0021] As a possible implementation, the detection flag information also includes a third field. The value of the third field is used to indicate the risk type when the first service message is at risk. This third field can provide the network management analyzer with richer risk information, facilitating further analysis, correlation, and other processing by the network management analyzer, thereby better ensuring service security.

[0022] Illustratively, the risk type includes one or more of the following: file-related risks, protocol-related risks, and website (world wide web, WEB)-related risks.

[0023] As a possible implementation, the first field in the detection tag information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. This facilitates service messages to carry detection tag information and realizes the identification of risky service flow forwarding paths.

[0024] As one possible implementation, the first service packet includes an in-situ flow information telemetry (IFIT) header, with detection flag information located within the IFIT header. This allows the network management analyzer to identify risky service flow forwarding paths while also identifying latency and packet loss within the service flow.

[0025] As a possible implementation, the first service message is an IPv6-based segment routing (SRv6) protocol message, and the IFIT message header is located in the extended header (SRH) of the first service message; or the first service message is a multiprotocol label switching (MPLS) protocol message, and the IFIT message header is located in the MPLS message header of the first service message. In this way, different types of service messages can carry detection tag information, thereby assisting the network management analyzer in identifying risky service flow forwarding paths.

[0026] In a second aspect, a message detection method is provided, which includes: a first network device encapsulates business flow data to be transmitted to obtain a first business message, the message header of the first business message includes detection mark information, the detection mark information includes a first field, the value of the first field is set to a first numerical value, and the first numerical value is used to indicate that there is no risk in the first business message; the first network device sends the first business message to the next-hop device on the business flow forwarding path.

[0027] The first network device is a source node on the service flow forwarding path.

[0028] The solution provided in the second aspect above encapsulates the detection mark information in the business message through the source node, and provides risk indication for the business message based on the detection mark information, so that the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the business message, thereby ensuring the security of the business.

[0029] As a possible implementation, the detection flag information further includes a second field, the value of which is set to a third value, indicating that the first service message has not undergone security detection. Thus, using the second field to indicate whether the first service message has undergone security detection facilitates targeted processing of the service message by the security device, thereby improving processing efficiency.

[0030] As one possible implementation, the detection flag information further includes a third field, the value of which is set to a fifth value. The fifth value indicates that the risk type of the first service message is to be set. Setting the third field facilitates the network management analyzer to identify the risk type, thereby ensuring service security.

[0031] Exemplarily, the risk types include one or more of the following: file risks, protocol risks, and website risks.

[0032] As a possible implementation, the first field in the detection tag information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. This facilitates service messages to carry detection tag information and realizes the identification of risky service flow forwarding paths.

[0033] As one possible implementation, the first service packet includes an in-flight detection (IFIT) header, with detection flag information located within the IFIT header. This allows the network management analyzer to identify risky service flow forwarding paths while also identifying latency and packet loss within the service flow.

[0034] As a possible implementation, the first service packet is an SRv6 protocol packet, and the IFIT header is located in the extended header (SRH) of the first service packet; or, the first service packet is an MPLS protocol packet, and the IFIT header is located in the MPLS header of the first service packet. In this way, different types of service packets can carry detection tag information, thereby assisting the network management analyzer in identifying risky service flow forwarding paths.

[0035] As a possible implementation, the method further includes: the first network device sending flow security status information to a network management analyzer, where the flow security status information indicates whether the first service packet is at risk. By sending the flow security status information to the network management analyzer, the network management analyzer can detect risky service flow packet forwarding paths based on the flow security status information.

[0036] As one possible implementation, the flow security status information includes flow identification information and detection flag information of the first service message. Thus, by sending the flow security status information to the network management analyzer, the network management analyzer can detect whether there is a risk in the forwarding path of the first service message based on the flow identification information and detection flag information of the first service message.

[0037] According to a third aspect, a message detection method is provided, the method comprising: a second network device receives a second service message from a previous-hop device on a service flow forwarding path, the message header of the second service message includes detection tag information, the detection tag information includes a first field, and the value of the first field is used to indicate whether the second service message is at risk; the second network device sends flow security status information to a network management analyzer, and the flow security status information is used to indicate whether the second service message is at risk.

[0038] Optionally, the second network device is an intermediate node on the service flow forwarding path. Optionally, the second network device is an end node on the service flow forwarding path.

[0039] The solution provided in the third aspect above sets detection mark information in the service message, indicates the risk of the service message based on the detection mark information, and sends flow security status information to the network management analyzer, so that the network management analyzer can identify the risky service flow forwarding path based on the detection mark information, thereby ensuring the security of the service.

[0040] As a possible implementation, the detection flag information also includes a second field, the value of which is used to indicate whether the second service message has been security-checked. Thus, using the second field to indicate whether the first service message has undergone security checking facilitates targeted processing of the service message by the security device, improving processing efficiency.

[0041] As one possible implementation, the detection flag information also includes a third field. The value of the third field is used to indicate the risk type when the second service message is at risk. This third field facilitates risk type identification at the management and analysis layer, thereby ensuring service security.

[0042] Exemplarily, the risk types include one or more of the following: file risks, protocol risks, and website risks.

[0043] As a possible implementation, the first field in the detection tag information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. This facilitates service packets to carry detection tag information and enables identification of risky service flow forwarding paths.

[0044] As one possible implementation, the second service message includes an in-flow detection IFIT message header, with detection flag information located within the IFIT message header. This allows the network management analyzer to identify the forwarding path of risky service flows while also identifying latency and packet loss within the service flow.

[0045] In one possible implementation, the second service packet is an SRv6 protocol packet, and the IFIT header is located in the extended header (SRH) of the second service packet; or, the second service packet is an MPLS protocol packet, and the IFIT header is located in the MPLS header of the second service packet. In this way, different types of service packets can carry detection tag information, thereby assisting the network management analyzer in identifying risky service flow forwarding paths.

[0046] As one possible implementation, the flow security status information includes flow identification information and detection flag information of the second service message. Thus, by sending the flow security status information to the network management analyzer, the network management analyzer can detect whether there is a risk in the forwarding path of the second service message based on the flow identification information and detection flag information of the second service message.

[0047] As a possible implementation, the method further includes: in response to the second network device being an intermediate node on the service flow forwarding path, the second network device sending the second service message to a next-hop device on the service flow forwarding path, thereby forwarding the second service message to the destination network node.

[0048] In a fourth aspect, a message detection method is provided, the method comprising: a network management analyzer receives flow security status information from a network device, the flow security status information includes flow identification information of the service message and detection tag information, the detection tag information includes a first field, and the value of the first field is used to indicate whether the service message is at risk; when the value of the first field indicates that the service message is at risk, an alarm information is output, the alarm information includes an identifier of a risky service flow forwarding path, or an identifier of some nodes in the risky service flow forwarding path, and the identifier of the risky service flow forwarding path is determined based on the flow identification information.

[0049] The solution provided in the fourth aspect above sets detection mark information in the service message and provides risk indication for the service message based on the detection mark information. In this way, after receiving the flow security status information, the network management analyzer can identify the risky service flow forwarding path based on the detection mark information in the flow security status information, thereby ensuring the security of the service.

[0050] In a fifth aspect, a security device is provided, which includes a receiving unit, a security detection unit and a sending unit; wherein the receiving unit is used to receive a first business message from a previous-hop device on a business flow forwarding path, and the message header of the first business message includes detection mark information, and the detection mark information includes a first field, and the first field is used to indicate whether there is a risk in the first business message; the sending unit is used to send a second business message to a next-hop device on the business flow forwarding path, wherein the second business message is the same as the first business message, or the second business message is obtained by updating the value of the first field in the first business message; the security detection unit is used to perform security detection on the first business message.

[0051] The beneficial effects of the security device provided in the fifth aspect can be found in the description of any embodiment of the first aspect and are not further elaborated here. The security device has the function of implementing the behavior of the method example of any embodiment of the first aspect. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0052] In a sixth aspect, a network device is provided, which includes a processing unit and a sending unit; wherein the processing unit is used to encapsulate the business flow data to be transmitted, thereby obtaining a first business message, and the message header of the first business message includes detection mark information, the detection mark information includes a first field, the value of the first field is set to a first numerical value, and the first numerical value is used to indicate that there is no risk in the first business message; the sending unit is used to send the first business message to the next-hop device on the business flow forwarding path.

[0053] The beneficial effects of the network device provided in the sixth aspect can be found in the description of any embodiment of the second aspect and are not further elaborated here. The network device has the function of implementing the behavior of the method example of any embodiment of the second aspect. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0054] In the seventh aspect, a network device is provided, which includes a receiving unit and a sending unit, wherein the receiving unit is used to receive a second business message from a previous-hop device on a business flow forwarding path, and the message header of the second business message includes detection mark information, and the detection mark information includes a first field, and the value of the first field is used to indicate whether the second business message is at risk; the sending unit is used to send flow security status information to a network management analyzer, and the flow security status information is used to indicate whether the second business message is at risk; the sending unit is used to send the second business message to the next-hop device on the business flow forwarding path when the network device is an intermediate node on the business flow forwarding path.

[0055] The beneficial effects of the network device provided in the seventh aspect can be found in the description of any embodiment of the third aspect and are not further elaborated here. The first network device has the function of implementing the behavior of the method example of any embodiment of the third aspect. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0056] In an eighth aspect, a network management analyzer is provided, which includes a receiving unit and an alarm unit, wherein the receiving unit is used to receive flow security status information from a network device, the flow security status information includes flow identification information of a business message, and detection tag information, the detection tag information includes a first field, and the value of the first field is used to indicate whether the business message is at risk; the alarm unit is used to output alarm information when the value of the first field indicates that the business message is at risk, the alarm information includes an identification of a business flow forwarding path at risk, or an identification of some nodes in the business flow forwarding path at risk. The identification of the business flow forwarding path at risk is determined based on the flow identification information.

[0057] The beneficial effects of the network management analyzer provided in the eighth aspect can be found in the description of any embodiment of the fourth aspect and are not further elaborated here. The first network device has the function of implementing the behavior of the method example of any embodiment of the fourth aspect. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0058] In the ninth aspect, an electronic device is provided, comprising: a memory for storing computer program instructions; a processor for executing computer program instructions to support the electronic device to implement a method as described in any possible implementation of the first aspect, or to implement a method as described in any possible implementation of the second aspect, or to implement a method as described in any possible implementation of the third aspect, or to implement a method as described in any possible implementation of the fourth aspect.

[0059] In the tenth aspect, a business flow transmission system is provided, comprising one or more security devices, one or more network devices and a network management analyzer; the security device is used to execute the method described in any possible implementation method of the first aspect, the network device is used to execute the method described in any possible implementation method of the second aspect or the method described in any possible implementation method of the third aspect, and the network management analyzer is used to execute the method described in any possible implementation method of the fourth aspect.

[0060] In the eleventh aspect, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processing circuit, the method described in any possible embodiment of the first aspect is implemented, or the method described in any possible embodiment of the second aspect is implemented, or the method described in any possible embodiment of the third aspect is implemented, or the method described in any possible embodiment of the fourth aspect is implemented.

[0061] In the twelfth aspect, a chip system is provided, which includes a processing circuit and a storage medium, in which computer program instructions are stored; when the computer program instructions are executed by the processing circuit, the method described in any possible embodiment of the first aspect is implemented, or the method described in any possible embodiment of the second aspect is implemented, or the method described in any possible embodiment of the third aspect is implemented, or the method described in any possible embodiment of the fourth aspect is implemented.

[0062] In the thirteenth aspect, a computer program product comprising instructions is provided, which, when the computer program product is run on a computer, enables the computer to execute a method as described in any possible implementation of the first aspect, or a method as described in any possible implementation of the second aspect, or a method as described in any possible implementation of the third aspect, or a method as described in any possible implementation of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] FIG1 is a diagram illustrating an application scenario of a message detection method provided in an embodiment of the present application;

[0064] FIG2 is a schematic diagram of a service chain provided in an embodiment of the present application;

[0065] FIG3 is a schematic diagram of the principle of out-of-band detection provided by an embodiment of the present application;

[0066] FIG4 is a schematic diagram of the principle of an in-band detection provided by an embodiment of the present application;

[0067] FIG5 is a schematic diagram of an IFIT encapsulation format in an IPv6 network environment provided by an embodiment of the present application;

[0068] FIG6 is a schematic diagram of the encapsulation format of an SRv6 message in an SRv6 network environment provided by an embodiment of the present application;

[0069] FIG7 is a schematic diagram of an IFIT encapsulation format in an MPLS network environment according to an embodiment of the present application;

[0070] FIG8 is a second schematic diagram of an IFIT encapsulation format in an MPLS network environment provided by an embodiment of the present application;

[0071] FIG9 is a third schematic diagram of an IFIT encapsulation format in an MPLS network environment provided by an embodiment of the present application;

[0072] FIG10 is a schematic diagram showing the principle of flow detection according to an embodiment of the present application;

[0073] FIG11 is a system architecture diagram of a service flow transmission system applicable to the message detection method provided in an embodiment of the present application;

[0074] FIG12 is a schematic diagram of a service flow forwarding path provided in an embodiment of the present application;

[0075] FIG13 is a schematic diagram showing the principle of security detection of a security device provided in an embodiment of the present application;

[0076] FIG14 is a flow chart of a message detection method according to an embodiment of the present application;

[0077] FIG15 is a schematic diagram of one of the packaging formats of detection mark information provided in an embodiment of the present application;

[0078] FIG16 is a second schematic diagram of the packaging format of the detection mark information provided in an embodiment of the present application;

[0079] FIG17 is a third schematic diagram of the packaging format of the detection mark information provided in an embodiment of the present application;

[0080] FIG18 is a second flow chart of the message detection method provided in an embodiment of the present application;

[0081] FIG19 is a schematic diagram of one of the safety detection flow charts of the safety device provided in an embodiment of the present application;

[0082] FIG20 is a second schematic diagram of a safety detection process of a safety device provided in an embodiment of the present application;

[0083] FIG21 is a third flow chart of the message detection method provided in an embodiment of the present application;

[0084] FIG22 is a fourth flow chart of the message detection method provided in an embodiment of the present application;

[0085] FIG23 is a schematic diagram of an application of a message detection method provided in an embodiment of the present application;

[0086] FIG24 is a schematic structural diagram of a security device 100 provided in an embodiment of the present application;

[0087] FIG25 is a schematic structural diagram of a security device 200 provided in an embodiment of the present application;

[0088] FIG26 is a schematic diagram of a structure of a network device 300 provided in an embodiment of the present application;

[0089] FIG27 is a schematic diagram of a structure of a network device 400 provided in an embodiment of the present application;

[0090] FIG28 is a schematic diagram of the structure of a network device 500 provided in an embodiment of the present application;

[0091] FIG29 is a schematic diagram of a structure of a network device 600 provided in an embodiment of the present application;

[0092] FIG30 is a schematic diagram of the structure of a network management analyzer 700 provided in an embodiment of the present application;

[0093] FIG31 is a structural diagram of a network management analyzer 800 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0094] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0095] In the following, the terms "first," "second," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the quantity of the technical features indicated. Therefore, a feature specified as "first," "second," etc. may explicitly or implicitly include one or more of the features.

[0096] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0097] In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more. "And / or" in this document is merely a description of the association relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone.

[0098] Firewall technology is a technology that helps a computer network build a relatively isolated protective barrier between its internal and external networks, thereby protecting user data and information security.

[0099] The main function of firewall technology is to promptly detect and deal with security risks, data transmission and other problems that may exist during the operation of computer networks. The treatment measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation, protect the integrity of user data and information, and provide users with a better and safer computer network experience.

[0100] Currently, when a firewall discovers that a computer network is under attack during operation, it will block some messages, such as discarding data packets (also known as "packet loss") to ensure the security of the computer network operation. However, network operation and maintenance personnel cannot know the cause of the traffic packet loss, nor can they know the threatening message forwarding path in the network, which affects business security.

[0101] Based on the above research, an embodiment of the present application provides a message detection method, an electronic device and a computer-readable storage medium. By setting detection mark information in the message and indicating the risk of the business message according to the detection mark information, it can assist in identifying risky business flow forwarding paths at the management and control analysis layer.

[0102] Please refer to Figure 1, which is an application scenario diagram of the message detection method provided in an embodiment of the present application. The deployment of each device in Figure 1 is implemented based on business chain programming technology.

[0103] Among them, service function chaining (SFC) is a technology that provides orderly services to the application layer. Service chain is used to connect services on various devices at the logical level to form an orderly service combination. Service chain ensures that the message passes through each device in sequence along the specified path by adding service chain path information to the original message.

[0104] Among them, different devices can play different roles in the entire service chain system according to their different functions. As shown in Figure 2, the roles of the service chain mainly include classifier (SC), service node (SF), proxy server (proxy server), and service chain forwarding node (SFF).

[0105] The classifier is located at the boundary entrance of the SFC domain. After entering the detection domain, packets from application A first enter the classifier, where they are classified, service identifiers are set, and service headers are encapsulated. The SFC domain refers to the area containing SFC devices, such as R1 to R10 and FW1 to FW7 in Figure 1.

[0106] Service nodes are devices that provide value-added service functions, including firewalls, load balancing devices, etc.

[0107] The proxy server is located between the service chain forwarding node and its associated SF, and removes or adds network service header (NSH) encapsulation information for the SF.

[0108] The service chain forwarding node is used to forward the message received from the network to several SFs associated with the SFF. After processing, the SF returns the message to the same SFF for forwarding.

[0109] When application messages are transmitted in the network, they often need to pass through various service nodes to ensure that the network can provide users with secure, fast, and stable services according to pre-planned conditions. These service nodes include well-known firewalls and load balancers (LBs). Traffic needs to pass through these service nodes in the established order required by the business logic to achieve the required business.

[0110] In Figure 1, FW1, FW2, FW3, FW4, FW5, FW6, and FW7 are security devices, such as firewalls. R1, R2, R3, R4, R5, R6, R7, R8, R9, and R10 are network devices. In Figure 1, security devices FW3, FW4, FW5, and FW6 form a security resource pool. The security resource pool and security devices are managed and maintained by security operations personnel, while the network management analyzer is managed and maintained by network operations personnel. The network management analyzer also manages network devices. Furthermore, the network management analyzer orchestrates security and network devices through service chains, allowing service flows to be transmitted along these orchestrated paths.

[0111] As shown in Figure 1, the service flow of application A can be forwarded from network device R1, through security device FW1, network device R3, network device R5, security device FW3, security device FW4, security device FW5, security device FW6, network device R7, network device R9, and security device FW7 to reach application B.

[0112] When the service flow in Figure 1 is transmitted based on the orchestrated path, the network device can detect packet loss and delay of the service flow when passing through the network device.

[0113] As shown in Figure 3, Figure 3 is a schematic diagram of the principle of out-of-band detection provided by an embodiment of the present application. Network equipment can detect the delay, packet loss, etc. of the input business flow through out-of-band detection, such as the two-way active measurement protocol (TWAMP), Internet packet explorer (Ping), trace router (Tracert), etc. One type of out-of-band detection is a detection method that realizes detection by constructing a detection message and sending an additional simulated flow, such as the input network device (ingress) in Figure 3 can send a simulated flow to the output network device (egrss). However, when out-of-band detection is actually applied, the forwarding path of the simulated flow may be inconsistent with the forwarding path of the real business flow, resulting in low detection accuracy.

[0114] As shown in Figure 4, Figure 4 is a schematic diagram of the principle of in-band detection provided by an embodiment of the present application. Network equipment can also detect problems such as delay and packet loss in business flows through in-band detection. For example, the Y.1731 protocol, the Y.1711 protocol, etc. adopt the in-band detection method. In-band detection can insert sampled detection messages into the input business flow, such as the input network device in Figure 4 can insert sampled detection messages into the input business flow, and send the sampled detection messages to the output network device to detect the delay and packet loss of the business flow. Since in-band detection sends sampled detection messages at intervals, the detection accuracy is relatively low.

[0115] In order to improve the accuracy of detection, in the embodiment of the present application, in-situ flow information telemetry (IFIT) technology is used to detect service flow delay, packet loss, etc. When performing in-situ flow detection, the head node will encapsulate the message with an IFIT message header.

[0116] It is understandable that in different network environments, the message types are different, and accordingly, the encapsulation of the IFIT header is also different. For example, in the sixth version of the Internet Protocol (IPv6) network environment, the message is an IPv6 message, and the IFIT header is encapsulated in the IPv6 message header. For another example, in a segment routing over IPv6 (SRv6) network environment, the message is an SRv6 message, and the IFIT header is encapsulated in the extended header (segment routing header, SRH) of the SRv6 message. For another example, in a multiprotocol label switching (MPLS) network environment, the message is an MPLS message, and the IFIT header is encapsulated in the MPLS message header of the MPLS message.

[0117] The following uses an IPv6 network environment as an example for explanation. In an IPv6 network environment, the IFIT encapsulation format of an IPv6 packet is shown in Figure 5. In Figure 5, the extended header of the IPv6 packet includes an option type field, an option data length (Opt Data Len) field, a service flow ID (FlowMonID) field, an L field, a D field, and a reserved field. Opt Data Len is the length of the data in the option type, L is the packet loss detection coloring flag bit, and D is the delay detection coloring flag bit. As an example, the length of the option type field is 8 bits, the length of the Opt Data Len field is 8 bits, the length of the FlowMonID field is 20 bits, the length of the L field is 1 bit, and the length of the D field is 1 bit.

[0118] It is understood that Figure 5 is only a schematic diagram of the IPv6 iFit encapsulation format. The order of the fields in the figure can be adjusted according to actual needs. For example, the D field is located after the L field. For another example, the D field is located before the L field. There is no specific limitation.

[0119] For a detailed description of the above fields, please refer to the relevant description of the document "RFC9343 IPv6 Application of the Alternate-Marking Method". The above document is incorporated into this application by reference in its entirety and will not be repeated here.

[0120] The following uses an SRv6 network environment as an example. In an SRv6 network environment, the outer layer of the SRv6 message is IPv6, but SRH information is added to the extended message header of the IPv6 message. Therefore, in an SRv6 network environment, the IFIT encapsulation format of the SRv6 message can be seen in Figure 5.

[0121] For ease of understanding, the IFIT encapsulation format of an SRv6 message is described in detail below. Please refer to Figure 6, which is a schematic diagram of the encapsulation format of an SRv6 message in an SRv6 network environment provided by an embodiment of the present application. As shown in Figure 6, an SRv6 message includes an ETH field, an IPv6 Basic Header field, an SRH field, and a payload.

[0122] The ETH field is used to carry the Layer 2 Ethernet header, which can carry the source MAC address, destination MAC address, and protocol type.

[0123] IPv6 Basic Header is the IPv6 basic header.

[0124] The SRH field includes the SRH Basic Header field, the Segment List field, and related information for in-flow detection. The SRH Basic Header is an extension of the SRH basic header. The Segment List field is used to carry a list of segments indicating the service flow forwarding path. Related information for in-flow detection includes the Flow Instruction Indicator (FII) field, the Flow Instruction Header (FIH) field, and the Flow Instruction Extension Header (FIEH) field.

[0125] The FII field primarily identifies the beginning of the IFIT header and defines the overall length of the IFIT header. The FII field consists of a Type field, a Length field, and a Reserved field. The Type field identifies the IFIT detection header, and the Length field identifies the length of the FIH and FIEH fields. For example, the Type field is 8 bits long, and the Length field is 8 bits long.

[0126] The FIH field is primarily used to uniquely identify a service flow. Optionally, the FIH field includes the service flow ID (Flow ID) field, the L field, the D field, the R field, the R / S field, and the NextHeader field. The Flow ID field is used to identify the ID information of the service flow. L is the packet loss detection coloring flag, D is the delay detection coloring flag, and R is the reserved flag, reserved for future expansion. The R / S field is used to indicate that when the leading label is at the bottom of the stack, R is retained. It is set to 1 by default. If the leading label is not at the bottom of the stack, S is retained. The NextHeader field indicates whether an extended header is carried. For example, a NextHeader value of 0x00 indicates reserved. A NextHeader value of 0x01 indicates that the FIH is basic end-to-end detection information and does not carry an extended header. A NextHeader value of 0x02 indicates that the FIH is basic hop-by-hop detection information and does not carry an extended header. A NextHeader value of 0x03 indicates that the FIH is extended end-to-end detection information and carries an extended header, and the FIEH is valid. A NextHeader value of 0x04 indicates that the FIH is extended hop-by-hop detection information and carries an extended header, and the FIEH is valid. As an example, the length of the Flow ID field is 20 bits, the length of the L field is 1 bit, the length of the D field is 1 bit, the length of the R field is 1 bit, the length of the R / S field is 1 bit, and the length of the NextHeader field is 8 bits.

[0127] The FIEH field is used to carry other IFIT detection-related information. The FIEH field includes option data. The specific content in the FIEH field can be set according to business requirements and is not specifically limited. The message detection method provided in the embodiment of the present application does not involve the FIEH field.

[0128] It can be understood that FIG6 is only a schematic diagram of the IFIT encapsulation format in an SRv6 network environment. The order of the fields in the figure can be adjusted according to actual needs and is not specifically limited.

[0129] The following uses an MPLS network environment as an example to illustrate the IFIT encapsulation format of an MPLS packet in an MPLS network environment. For example, as shown in Figure 7, an MPLS packet includes a TC field, an S field, a Time To Live (TTL) field, a Flow-ID Label Indicator field, a Flow-ID Label field, an L field, a D field, and a T field. The Flow-ID Label Indicator field identifies the IFIT detection header, the Flow-ID Label field identifies the ID information of the service flow, the TC field refers to the Traffic Class field, which identifies the corresponding traffic flow category, or priority level. The S field indicates that if the leading label is at the bottom of the stack, the R field is retained; if the leading label is not at the bottom of the stack, the S field is retained. The L field is the packet loss detection coloring flag, the D field is the delay detection coloring flag, and the T field indicates the detection type. For example, when the T field is set to 1, it is end-to-end detection, and when the T field is set to 0, it is hop-by-hop detection. As an example, the length of the TC field is 3 bits, the length of the S field is 1 bit, the length of the TTL field is 8 bits, the length of the Flow-ID Label Indicator field is 20 bits, the length of the Flow-ID Label field is 20 bits, the length of the L field is 1 bit, the length of the D field is 1 bit, and the length of the T field is 1 bit.

[0130] For a detailed description of the above fields, please refer to the relevant description in the document "Encapsulation For MPLS Performance Measurement with Alternate Marking Method", which is incorporated into this application by reference in its entirety and will not be repeated here.

[0131] As an example, in an MPLS network environment, the encapsulation format of an MPLS packet is shown in Figure 8. The MPLS packet shown in Figure 8 includes an ETH field, an SR Label field, a VPN Label field, an IFIT field, and a payload. The ETH field carries the Layer 2 Ethernet header, which carries the source MAC address, destination MAC address, and protocol type. The SR Label field carries the public network label. The VPN Label field carries the private network label. The IFIT field includes the FII field, the FIH field, and the FIEH field.

[0132] The FII field includes the Flow Indicator Label (FII Label), EXP, S, and Time to Live (TTL) fields. The FII Label field identifies the IFIT detection header; the EXP field is the priority EXP flag, which is determined based on some relevant information in the outer MPLS label header; the S field indicates whether the packet is at the bottom of the stack, for example, a value of 1 indicates the bottom of the stack, and a value of 0 indicates not at the bottom of the stack; and the TTL field is determined based on some relevant information in the outer MPLS label header. As an example, the FII Label field is 20 bits long, the EXP field is 3 bits long, the S field is 1 bit long, and the TTL field is 8 bits long.

[0133] The FIH field includes a Flow ID field, an L field, a D field, an R field, an R / S field, and a header type indicator (HTI) field. Among them, the Flow ID field, the L field, the D field, the R field, and the R / S field refer to the above description in the SRv6 network environment. HTI is used to identify the node range and detection content range to which the IFIT detection results need to be sent. For example, different tag values ​​are used to distinguish whether the path nodes with IFIT capabilities are detected in addition to the nodes at both ends, and whether the FIEH field is valid. As an example, the length of the Flow ID field is 20 bits, the length of the L field, the D field, the R field, and the R field is 1 bit, and the length of the HTI field is 8 bits.

[0134] The FIEH field is used to carry other IFIT detection-related information. The FIEH field includes option data. The specific content in the FIEH field can be set according to business needs and is not specifically limited.

[0135] After the IFIT message header is expanded, the format of the IFIT message header is shown in (a) of FIG9 . When the HTI is 0x03 or 0x04, the FIEH field is valid, and the encapsulation format is shown in (b) of FIG9 .

[0136] It can be understood that FIG7 , FIG8 and FIG9 are only schematic diagrams of the IFIT encapsulation format of MPLS, and the order of the fields in the figures can be adjusted according to actual needs and is not specifically limited.

[0137] Through IFIT encapsulation, network devices can color the packet loss detection coloring flag bit (L) and the delay detection coloring flag bit (D) during delay and packet loss detection. By counting the colored packets within a fixed period, packet loss and delay detection can be achieved. Coloring packets refers to the addition of characteristic markings to the packet loss detection coloring flag bit (L) and the delay detection coloring flag bit (D).

[0138] As an example, a network device implements feature marking by setting the packet loss detection bit L and the delay detection bit D. For example, when the packet loss detection bit L is set to 1, packet loss is collected; when the packet loss detection bit L is set to 0, packet loss is not collected; when the delay detection bit D is set to 1, timestamps are collected; when the delay detection bit D is set to 0, timestamps are not collected.

[0139] Please refer to Figure 10, which is a schematic diagram of the principle of flow detection provided by an embodiment of the present application. As shown in Figure 10, when detecting packet loss in a service flow based on the IFIT flow detection technology, the head and tail nodes dye and count the packet loss detection dyeing mark bit L of the message according to a fixed period, and report the counted number of messages to the network management analyzer. The network management analyzer compares the number of messages in each period to detect whether packet loss occurs. For example, assuming that the head node sends 5 messages in the dyeing period T2, and the tail node receives 3 in the dyeing period T2, after the head node and the tail node report to the network management analyzer, the network management analyzer compares the number of messages reported by the head node and the tail node, and can obtain that 2 messages were lost in the dyeing period T2.

[0140] Accordingly, based on the IFIT flow-based detection technology, service flow latency is detected. As shown in Figure 10, the head node colors the latency detection coloring flag bit D and records the time the colored message was sent using a timestamp. The tail node also records the time the colored message was received using a timestamp. The head node and tail node then report this time information to the network management analyzer. The network management analyzer calculates the time difference to obtain the one-way delay value of the message.

[0141] In-flight detection technology typically uses two main methods: hop-by-hop detection and end-to-end detection. End-to-end detection detects stained packets only at the head and tail nodes, without processing them at intermediate nodes. This allows for end-to-end packet loss and latency monitoring. Hop-by-hop detection detects stained packets at each network device along the way, allowing for hop-by-hop packet loss and latency monitoring.

[0142] As an example, in the initial state, network operation and maintenance personnel can use the network management analyzer to send end-to-end IFIT packet loss detection for the service flow; when traffic packet loss is found, hop-by-hop IFIT packet loss detection is sent again to accurately determine the packet loss location. The IFIT detection results are reported to the control analyzer, which performs data analysis and collation.

[0143] The embodiment of the present application directly colors real business messages through the IFIT flow detection technology, which can actively perceive subtle changes in the network and truly reflect the packet loss and delay conditions of the network.

[0144] Thanks to advances in service chain programming technology, the security devices in Figure 1 can be flexibly deployed anywhere in the network in a pooled and centralized manner. As service flows pass through the security devices, they perform security checks on demand. If a threat is detected, the security devices can block the flow or issue an alarm.

[0145] In an embodiment of the present application, the security equipment and the security resource pool are under the responsibility of the security operation and maintenance personnel, while the network equipment is managed by the network operation and maintenance personnel. The security equipment does not support the IFIT flow detection function, and the security equipment does not report the security detection results to the network management analyzer. Therefore, when the security device finds that the computer network is attacked during operation and blocks some messages, such as discarding data packets (also called "packet loss") to ensure the security of the computer network operation, the network operation and maintenance personnel do not know the reason for the packet loss. Moreover, when the security device only issues an alarm for the attacked message and does not block the packet loss, the network operation and maintenance personnel cannot know the risky business flow forwarding path in the network, thereby affecting business security.

[0146] Please refer to Figure 11, which is a system architecture diagram of a service flow transmission system applicable to the message detection method provided in the embodiment of the present application. As shown in Figure 11, the service flow transmission system provided in the embodiment of the present application includes a management and control analysis layer and an infrastructure layer, wherein the management and control analysis layer includes a network management analyzer, and the infrastructure layer includes multiple network devices and security devices, and the multiple network devices and security devices are connected through communication links for transmitting service flows. In the embodiment of the present application, the network device is used to forward service messages of types such as MPLS / SRv6 and to perform in-flow detection on the service messages, and report the in-flow detection data to the network management analyzer. Exemplarily, the network device is a routing switching device.

[0147] In an embodiment of the present application, the security device is used to forward service packets such as MPLS packets / SRv6 packets and perform security checks on the service packets.

[0148] In the embodiment of the present application, the network management analyzer is used to manage network devices, present network topology, and collect and integrate the flow security status information uploaded by each network device to restore the attack path. Optionally, the network management analyzer is a device or a collection of multiple devices.

[0149] As an example, multiple network devices and security devices can be deployed through a network management analyzer based on service chain technology to form a service flow forwarding path as shown in Figure 12. On the service flow forwarding path, network device R1 is the source node, network device R2, security device FW1, security device FW2, and network device R3 are intermediate nodes, and network device R4 is the tail node.

[0150] The service flow data sent by the source device can reach the destination device along the service flow forwarding path, through the network device R1, the network device R2, the security device FW1, the security device FW2, the network device R3 and the network device R4.

[0151] The source device refers to the device that generates the service flow, such as the node device where application A or application B is located in Figure 2, and the destination device refers to the node that receives the service flow, such as the node device where application A or application B is located in Figure 2. For example, when the node device where application A is located is the source device, the node device where application B is located is the destination device.

[0152] In an embodiment of the present application, in order to realize the delay and packet loss detection of the service flow, when the service flow is forwarded from the network device R1 to the network device R4, the network operation and maintenance personnel can deploy hop-by-hop in-flow detection IFIT for the service flow through the network management analyzer, that is, when the service message passes through each network device, the network device can perform in-flow detection IFIT and report it to the network management analyzer.

[0153] In an embodiment of the present application, in order to achieve security detection of business flows, when the business flow is forwarded from the network device R1 shown in Figure 12 to the network device R4, the security device can perform security detection on the business message when the business message passes through one or more security devices between the network device R1 and the network device R4.

[0154] When performing security checks on service packets, security devices can filter and match the service packet's five-tuple according to pre-set filtering rules to control the forwarding of service packets. Filtering rules can be set based on actual service needs and are not specifically limited here. The service packet's five-tuple refers to the service packet's source address, destination address, source port, destination port, and protocol type.

[0155] Considering that in actual applications, the quintuples of malicious traffic carrying content attacks often change frequently, or the inner payload carries threat information under the same quintuple, it is impossible to detect risky messages in the service flow through quintuple detection alone. In order to improve the security of network operation, in an embodiment of the present application, the security detection of service messages also includes content security detection. By scanning the payload of the service message, the message features such as antivirus and content filtering are combined with the quintuple detection to achieve detection of the transport layer, session layer, presentation layer, and application layer (L4-L7 layers) of the service message.

[0156] As shown in Figure 13, for service flows, security devices can first match and filter service packets based on traffic matching policies. Traffic matching policies include matching criteria such as user, source / destination security zone, source / destination address, source / destination region, VLAN ID, service, application, URL category, and time period. The security device then matches service packets within the service flow based on these matching criteria, obtains a matching result, and then executes a corresponding response action (allow or deny) based on the matching result. When executing a deny action, the security device provides feedback on whether the packet was sent and can handle the service packet, such as generating an alarm or discarding it. When executing an allow action, the security device can further perform content security testing on the service packet. Content security testing generally includes protocol filtering, file filtering, and website filtering. Protocol filtering can include intrusion prevention systems (IPS), application behavior control and auditing, and email filtering. File filtering includes file filtering, anti-virus (AV), and content filtering. Web site filtering includes Uniform Resource Locator (URL) filtering and Domain Name System (DNS) filtering. After performing content security testing, the security device can provide feedback based on the security test results, indicating whether to send the service message. As can be understood, when sending the service message, the security device forwards the service message to the next-hop device on the service flow forwarding path.

[0157] In order to facilitate operations and maintenance personnel to identify threatening service messages and threatening service flow forwarding paths in service flows through a network management analyzer, in an embodiment of the present application, detection tag information for indicating security detection information is added to the IFIT message header of the service message. The detection tag information is reported to the network management analyzer via a network device, so that the network management analyzer can determine the risky service flow forwarding paths in the service flow based on the detection tag information.

[0158] For example, after a security device performs a security check on a service message, it can set a detection flag based on the security check result to indicate whether the service message is risky. After receiving the service message, the network device reports the IFIT test result and detection flag to the network management analyzer. The network management analyzer receives the detection flag and identifies the risky service flow forwarding paths within the service flow based on the detection flag. Operations and maintenance personnel can then use the network management analyzer to identify the risky service flow forwarding paths within the service flow.

[0159] For ease of understanding, the message detection method provided in the embodiment of the present application will be described below in conjunction with the accompanying drawings. Please refer to Figure 14, which is a flow chart of a message detection method provided in the embodiment of the present application. The method shown in Figure 14 can be applied to the service flow transmission system shown in Figure 11 and executed by a first network device. The first network device refers to the source node on the service flow forwarding path, such as the network device R1 in Figure 12. As shown in Figure 14, the message detection method provided in the embodiment of the present application can include steps S101 to S103.

[0160] S101, a first network device encapsulates service flow data to be transmitted to obtain a first service message, wherein a message header of the first service message includes detection mark information, the detection mark information includes a first field, and a value of the first field is used to indicate whether the service message has a risk.

[0161] The service flow data is data to be transmitted, which is sent from the source device to the first network device.

[0162] Optionally, in order to detect packet loss and delay of the service flow, the first network device performs in-flow detection IFIT encapsulation on the service flow data to be transmitted when encapsulating the service flow data to be transmitted.

[0163] It can be understood that when the first network device performs IFIT encapsulation on the business flow data to be transmitted, it can perform the encapsulation based on the current network environment. In this way, different types of business messages can carry detection tag information, thereby assisting the network management analyzer to identify the risky business flow forwarding path. For example, if the current network environment is MPLS, the first network device encapsulates the business flow data based on the message encapsulation format of MPLS, so that the first business message obtained is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first business message. For another example, if the current network environment is SRv6, the first network device encapsulates the business flow data based on the message encapsulation format of SRv6, so that the first business message obtained is an SRv6 protocol message, and the IFIT message header is located in the extended header SRH of the first business message. Please refer to the description of Figures 5 to 9 for the encapsulation format of IFIT in different network environments, which will not be repeated here.

[0164] In an embodiment of the present application, in order to detect risky service messages and service flow forwarding paths in a service flow, the first network device encapsulates detection tag information in the IFIT message header when performing IFIT encapsulation on the service flow data to be transmitted.

[0165] In an embodiment of the present application, the detection mark information includes a first field, and the value of the first field is used to indicate whether the service message has a risk.

[0166] As an example, to facilitate security detection and risk analysis of business messages, in an embodiment of the present application, the detection mark information can also include a second field and / or a third field, wherein the value of the second field is used to indicate whether the business message has been security detected, and the value of the third field is used to indicate the risk type of the risk when there is a risk in the business message.

[0167] By setting the second field, the embodiment of the present application enables the security device to perform security detection on the service message based on the detection status indicated by the second field, thereby facilitating the security device to perform targeted processing on the service message and improving processing efficiency.

[0168] In the embodiment of the present application, a third field is provided to indicate the risk type of the service message, thereby facilitating the network management analyzer to identify the risk type and thereby ensure service security. Considering that the IFIT encapsulation of the service message is different in different network environments, the encapsulation of the detection tag information is also different in different network environments.

[0169] As an example, in an MPLS network environment, that is, when the service packet is an MPLS packet, based on the IFIT encapsulation format of the MPLS packet as shown in Figure 7, the detection tag information is set in the row where the Flow-ID Label is located. For example, as shown in Figure 15, the row where the Flow-ID Label is located is used to set the first field, the second field, and the third field. Specifically, the row where the Flow-ID Label is located is used to mark whether the packet has been security-checked, whether there is a risk, and the risk type.

[0170] As an example, in an SRv6 network environment, that is, when the service message is an SRv6 message, based on the IFIT encapsulation format shown in Figure 5, the detection flag information is set in the row where the FlowMonID is located. For example, as shown in Figure 16, the first field, the second field, and the third field are set using the row where the FlowMonID is located, that is, the row where the FlowMonID is located is used to mark whether it has been security detected, whether there is a risk, and the risk type.

[0171] As an example, the first field occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, when setting the detection tag information in the service message, it is possible to avoid the detection tag information occupying too many bits, thereby increasing the amount of data carried by the service message. As an example, as shown in (a) of Figure 17, the first field, the second field, and the third field are added to the 5 bits 24 to 28 of the row where the Flow-ID Label is located. As an example, as shown in (b) of Figure 17, the first field, the second field, and the third field are set to the 5 bits 24 to 28 of the row where the FlowMonID is located. In this way, it is possible to avoid affecting other fields in the IFIT message header and improve bit utilization.

[0172] It can be understood that since the first network device is the source node on the service flow forwarding path, the first service message encapsulated by the first network device has not undergone security detection on the service flow forwarding path. Therefore, in an embodiment of the present application, when the first network device encapsulates the message, the value of the first field is set to the first numerical value, and the first numerical value is used to indicate that there is no risk in the first service message.

[0173] Correspondingly, since the first business message encapsulated by the first network device has not undergone security detection on the business flow forwarding path, the value of the second field is also set to the third value, and the third value is used to indicate that the first business message has not been security detected. The value of the third field is also set to the fifth value, and the fifth value is used to indicate that the risk type of the first business message is to be set.

[0174] It is understandable that the first value, the third value, and the fifth value are merely used to indicate the security detection information expressed by the first field, the second field, and the third field, and the first value, the third value, and the fifth value can be the same value. For example, the first value, the third value, and the fifth value can all be 0 to indicate that the first service message does not pose a risk, that the first service message has not been security-detected, or that the risk type of the first service message is to be set.

[0175] In some embodiments of the present application, the first value, the third value, and the fifth value can also be different values, which can be set specifically according to business needs, and this application does not impose any restrictions.

[0176] In the embodiment of the present application, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0177] Please refer to Table 1, which shows an example of detection tag information. As shown in Table 1, when the value of the first field is 0, it indicates that there is no risk in the business message; when the value of the first field is 1, it indicates that there is a risk in the business message; when the value of the second field is 0, it indicates that the business message has not been security detected; when the value of the second field is 1, it indicates that the business message has been security detected; when the value of the third field is 0, it indicates that the risk type of the business message is to be set; when the value of the third field is 1, it indicates that the risk type of the business message is the risk type of file class filtering; when the value of the third field is 2, it indicates that the risk type of the business message is the risk type of protocol class filtering; when the value of the third field is 3, it indicates that the risk type of the business message is the risk type of WEB website class filtering; when the value of the third field is 4-7, it indicates that the risk type of the business message is reserved, which is set specifically according to business needs.

[0178] Table 1

[0179] The embodiment of the present application encapsulates detection mark information in the business message and uses the detection mark information to indicate the risk of the business message, so that the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the business message, thereby ensuring the security of the business.

[0180] It is understandable that after encapsulating the first service message, the first network device can forward the first service message to the destination device. Furthermore, to facilitate the network management analyzer's identification of risks associated with the service flow during transmission, the first network device also sends detection flag information for the first service message to the network management analyzer after encapsulating the first service message. Therefore, after obtaining the first service message, steps S102 and S103 are also included.

[0181] S102: The first network device sends a first service packet to a next-hop device on a service flow forwarding path.

[0182] S103: The first network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message is at risk.

[0183] In an embodiment of the present application, the flow security status information includes the flow identification information and detection mark information of the first business message, wherein the flow identification information refers to the identification information of the flow in which the first business message is located, such as the Flow ID in the IFIT message header of the first business message.

[0184] It can be understood that the service packets of the same flow have the same flow identification information.

[0185] As an example, the flow identification information includes one or more of the source address, source port, destination address, and destination port of the service message.

[0186] Because the first network device performs in-flow detection IFIT encapsulation on the service flow data, in order to obtain the latency and packet loss status of the service flow, the flow security status information also includes in-flow detection data. As an example, the in-flow detection data includes information such as the timestamp of the first service packet whose delay detection coloring flag bit D is colored, the number of first service packets sent whose packet loss detection coloring flag bit L is colored, and the statistical period. This embodiment of the present application uploads the in-flow detection data to the network management analyzer, enabling the network management analyzer to obtain latency and packet loss information in the service flow based on the in-flow detection data.

[0187] The "source node / head node" and "tail node" in the embodiments of the present application refer to the service flow forwarding path, while the "source address" and "destination address" are concepts referring to the source device and destination device when the service message is transmitted in the entire network. The two are different in scope.

[0188] The embodiment of the present application uploads the flow identification information and the detection mark information to the network management analyzer, so that the network management analyzer can identify the risky business flow forwarding path in each business flow based on the flow identification information and the detection mark information.

[0189] In an embodiment of the present application, the first network device serves as a source node on a service flow forwarding path. After the first network device encapsulates a first service message, it sends the first service message to a next-hop device.

[0190] Optionally, the next hop device of the first network device is another network device. For example, in the service flow forwarding path shown in FIG12 , the next hop device of network device R1 is network device R2, which is an intermediate node. Optionally, the next hop device of the first network device is also a security device, depending on the service flow forwarding path.

[0191] For ease of understanding, the following describes the processing performed by security devices along the service flow forwarding path, with reference to the accompanying figures. Please refer to Figure 18 , which illustrates another flow chart of the message detection method provided in an embodiment of the present application. The method illustrated in Figure 18 can be applied to the service flow transmission system illustrated in Figure 11 and executed by a security device. For example, it can be executed by security device FW1 or security device FW2 in Figure 12 . As shown in Figure 18 , the message detection method provided in an embodiment of the present application further includes steps S201 to S202.

[0192] S201, a security device receives a first service message from a previous-hop device on a service flow forwarding path, wherein a message header of the first service message includes detection tag information, and the detection tag information includes a first field, wherein a value of the first field is used to indicate whether the first service message has a risk.

[0193] Optionally, for a security device, the previous hop device on the service flow forwarding path is one of the first network device, other network devices other than the first network device, and other security devices. There is no specific restriction and it depends on the service flow forwarding path.

[0194] For example, when the security device is the security device FW1 in Figure 12, the previous hop device on the service flow forwarding path is the network device R2; when the security device is the security device FW2 in Figure 12, the previous hop device on the service flow forwarding path is the network device R3.

[0195] In an embodiment of the present application, a message header of a first service message received by a security device includes detection tag information. Exemplarily, an IFIT message header of the first service message received by the security device includes detection tag information. When the first service message is an MPLS protocol message, the IFIT message header is located in the MPLS message header of the first service message. When the first service message is an SRv6 protocol message, the IFIT message header is located in an extended header (SRH) of the first service message.

[0196] In an embodiment of the present application, the detection mark information includes a first field, and the value of the first field is used to indicate whether the first service message has a risk.

[0197] It is understandable that when the first service message encapsulated by the first network device includes the second field and the third field, the first service message received by the security device also includes the second field and the third field. For the explanation of the second field and the third field, refer to the above explanation and are not repeated here.

[0198] The first service message received by the security device may be different from the first service message encapsulated by the first network device. For example, when the previous-hop device of the security device is another network device or another security device other than the first network device, the detection tag information of the first service message received by the security device may be different from the detection tag information of the first service message sent by the first network device.

[0199] S202: The security device sends a second service message to a next-hop device on the service flow forwarding path, where the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

[0200] The first service message refers to the service message received by the security device from the previous-hop device, and the second service message refers to the service message sent by the security device to the next-hop device on the service flow forwarding path.

[0201] Optionally, the second service message is the same as the first service message, or is obtained by updating the detection mark information in the first service message, such as updating the value of the first field in the first service message.

[0202] Exemplarily, when the security device does not perform security detection on the received first service message and only forwards the first service message, the second service message is the same as the first service message.

[0203] For example, after the security device performs a security check on the received first business message, it can update the value of the first field in the first business message based on the security check result of whether the first business message poses a risk, and obtain a second business message. At this time, the second business message is obtained by updating the value of the first field in the first business message.

[0204] In an embodiment of the present application, the security device may determine whether to perform a security check on the received first service message according to a preset detection strategy. Optionally, the preset detection strategy determines whether to perform a security check on the first service message according to detection flag information in the first service message.

[0205] For example, after receiving the first service message, the security device can parse the frame header of the first service message to obtain the detection mark information of the first service message, and then determine whether security detection is required for the first service message based on the detection mark information and the preset detection strategy.

[0206] As an example, an embodiment of the present application determines whether to perform security detection on the first business message based on the detection mark information in the first business message, including the following (1) to (5).

[0207] (1) In response to the value of the second field in the detection flag information in the first service message being the third value, the security device performs a security check on the first service message.

[0208] The third value is used to indicate that the first service message has not been security-checked. Therefore, when the value of the second field in the detection flag information in the first service message is the third value, it indicates that the first service message has not been security-checked. To ensure the security of the network device, the security device performs a security check on the first service message. It is understandable that when the first service message has not been security-checked, the value of the first field in the first service message is the second value, and the value of the third field is the fifth value.

[0209] (2) In response to the value of the second field in the detection flag information in the first service message being the fourth value, the security device does not perform security detection on the first service message.

[0210] Among them, the fourth value is used to indicate that the first business message has been security detected. Therefore, when the value of the second field in the detection mark information in the first business message is the fourth value, it means that the first business message has been security detected. In order to save resources and reduce workload, in an embodiment of the present application, the security device does not perform security detection on the first business message.

[0211] (3) In response to the value of the first field in the detection flag information in the first service message being the first value, the security device performs a security detection on the first service message.

[0212] Among them, the first numerical value is used to indicate that there is no risk in the first business message. When the value of the first field in the detection mark information in the first business message is the first numerical value, it indicates that there is no risk in the first business message. At this time, in order to further ensure security, regardless of whether the first business message has been security detected, that is, regardless of whether the value of the second field is the third numerical value or the fourth numerical value, the security device performs a security check on the first business message. It can be understood that when the value of the first field of the detection mark information in the first business message is the first numerical value, the value of the third field is the fifth numerical value, and the fifth numerical value is used to indicate that the risk type of the first business message is to be set.

[0213] (4) In response to the value of the first field in the detection flag information in the first service message being the second value, the security device performs a security check on the first service message.

[0214] Among them, the second numerical value is used to indicate that there is a risk in the first business message. When the value of the first field in the detection mark information in the first business message is the second numerical value, it means that the first business message has been security detected and there is a risk. At this time, in order to further determine the risk situation, the security device performs a security detection on the first business message.

[0215] (5) In response to the value of the first field in the detection flag information in the first service message being the second value, the security device does not perform security detection on the first service message.

[0216] When the value of the first field in the detection mark information in the first business message is the second value, it means that the first business message has been security detected and there is a risk. In order to ensure network security, the first business message can be directly blocked at this time without security detection.

[0217] It can be understood that when the value of the first field of the detection mark information in the first service message is the second value, the value of the second field is the fourth value, and the value of the third field is the value corresponding to the detected risk type.

[0218] It is understood that the detection strategies listed above are merely examples, and the detection strategies described in the embodiments of this application may include more methods. For example, to ensure network security, in some embodiments, the security device performs a security check on each received first service message. The specific configuration is based on actual needs and is not specifically limited in this application.

[0219] The embodiment of the present application sets a preset detection strategy and determines whether to perform security detection on the first business message based on the detection mark information in the first business message. It can dynamically and flexibly adjust the security detection method of the business message, which is conducive to refined network security operation and maintenance.

[0220] To improve network transmission security, in this embodiment of the present application, before step S202, that is, before the security device sends the second service message to the next-hop device on the service flow forwarding path, the security device can also perform a security check on the first service message. Please refer to Figure 19, which is a schematic diagram of a security check process for the security device provided in this embodiment of the present application. As shown in Figure 19, in this embodiment of the present application, the step of the security device performing a security check on the first service message includes steps S301 to S305.

[0221] S301: The security device determines whether the flow identification information of the first service packet is the same as the flow identification information of the third service packet with risk that has been detected by the security device.

[0222] S302: In response to the flow identification information of the first service packet being identical to the flow identification information of the third service packet with risk detected by the security device, the security device determines that the first service packet has risk.

[0223] S303: In response to the flow identification information of the first service packet being different from the flow identification information of the third service packet with risk detected by the security device, the security device determines whether the first service packet includes a malicious feature in the malicious feature library.

[0224] S304: In response to the flow identification information of the first business message being different from the flow identification information of the third business message that the security device has detected as having risk, and the first business message not including the malicious features in the malicious feature library, the security device determines that the first business message is not at risk.

[0225] S305: In response to the flow identification information of the first service message being different from the flow identification information of the third service message detected by the security device as risky, and the first service message including a malicious feature in the malicious feature library, the security device determines that the first service message is risky.

[0226] In the embodiment of the present application, the message header of the first service message further includes flow identification information. After the security device parses the frame header of the first service message, it can obtain the flow identification information of the first service message.

[0227] In the embodiment of the present application, the third service message refers to a service message that has been previously security-checked by the security device and detected to be risky, and the security device stores flow identification information of the third service message.

[0228] To further ensure network security, in an embodiment of the present application, upon receiving a first service message, the security device matches the flow identification information of the first service message with the flow identification information of a third service message posing a risk, and also performs content security testing on the first service message. This multi-dimensional security testing of the first service message improves network security and identifies risky service messages posing potential threats. This, based on these potentially threatening service messages, can assist in identifying the attacked service flow forwarding path at the management and control analysis layer.

[0229] Optionally, when performing content security detection on the first business message, the first business message is first scanned to obtain message features in the first business message, and then the message features are matched with malicious features in a malicious feature library to detect whether the first business message includes malicious features in the malicious feature library.

[0230] Optionally, the malicious signatures in the malicious database are pre-built and can be updated in real time or periodically. The malicious signatures in the malicious database include signatures for different risk types. For example, when the risk type is file filtering, the malicious signatures include virus signatures and malicious file signatures; when the risk type is protocol filtering, the malicious signatures include behavioral intrusion signatures, etc. It is understood that the malicious signatures for different risk types can be constructed based on actual business needs and are not specifically limited here.

[0231] It can be understood that when the first service message has a certain malicious feature, it is determined that the first service message has a risk, and the risk type is the risk type corresponding to the malicious feature.

[0232] As an example, the security device first matches the flow identification information of the first business message with the flow identification information of the third business message, and determines whether the flow identification information of the first business message is the same as the flow identification information of the third business message. If the flow identification information of the first business message is different from the flow identification information of the third business message, the first business message is scanned to detect whether the first business message includes malicious features in the malicious feature library.

[0233] As an example, the security device simultaneously matches the flow identification information of the first business message with the flow identification information of the third business message and scans the first business message, that is, it synchronously detects whether the first business message includes malicious features in the malicious feature library and whether the flow identification information of the first business message is the same as the flow identification information of the third business message.

[0234] As an example, the security device first scans the first business message to detect whether the first business message includes malicious features in the malicious feature library, and then matches the flow identification information of the first business message with the flow identification information of the third business message to determine whether the flow identification information of the first business message is the same as the flow identification information of the third business message.

[0235] In an embodiment of the present application, when the security device obtains that the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk, it determines that the first business message belongs to a business message of a risky business flow, and then obtains the security detection result of the first business message, indicating that the first business message is at risk.

[0236] In an embodiment of the present application, when the security device obtains that the flow identification information of the first business message is different from the flow identification information of the third business message that has been detected to be at risk, and the security device detects that the first business message does not include malicious features in the malicious feature library, it is determined that the first business message is not a risky message and does not belong to a message of a risky business flow, and then the security detection result of the first business message indicates that there is no risk in the first business message.

[0237] In an embodiment of the present application, when the security device obtains that the flow identification information of the first business message is different from the flow identification information of the third business message that has been detected to be at risk, but the security device detects that the first business message includes malicious features in the malicious feature library, it is determined that the first business message is a risky message, and then the security detection result of the first business message indicates that the first business message is at risk.

[0238] Optionally, when the security device obtains that the first business message includes malicious features in the malicious feature library and determines that the first business message is a risky message, it updates the first business message to a third business message to update the stored flow identification information of the risky message to improve security.

[0239] As an example, in order to further strengthen security detection and determine risk information, when the security device obtains that the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk, the security device detects whether the first business message includes malicious features in the malicious feature library.

[0240] In an embodiment of the present application, when the security detection result indicates that the flow identification information of the first service message is the same as the flow identification information of the third service message, but the first service message does not include malicious features, it indicates that the first service message belongs to a risky service flow message. The first service message is risky, but it is a potential threat and not a risky message. When the security detection result indicates that the flow identification information of the first service message is the same as the flow identification information of the third service message, and the first service message includes malicious features, it indicates that the first service message is a risky message and poses a threat.

[0241] The embodiment of the present application achieves security detection of the first service message from multiple dimensions by matching the flow identification information of the first service message with the flow identification information of the risky third service message, and performing content security detection on the first service message, thereby improving network security. In addition, it can also identify risky service messages that pose potential threats, thereby assisting in identifying the attacked service flow forwarding path at the management and control analysis layer based on the service messages that pose potential threats.

[0242] In the embodiment of the present application, after the security device performs a security check on the first service message, the security device updates the detection tag information in the first service message according to the security check result to obtain a second service message.

[0243] Exemplarily, the value of the second field in the detection mark information in the first business message is a third value. After the security device performs security detection on the first business message, the value of the second field in the detection mark information in the first business message is set to a fourth value. The fourth value is used to indicate that the first business message has been security detected. At the same time, based on the result of the security detection, the value of the first field and the value of the third field in the detection mark information are updated to obtain a second business message.

[0244] If the security detection result of the first service message indicates that the first service message is at risk, the value of the first field in the detection flag information is set to a second value, where the second value is used to indicate that the first service message is at risk. If the security detection result of the first service message indicates that the first service message is not at risk, the value of the first field in the detection flag information is the first value.

[0245] Among them, when the security device detects that the first business message has a risk, the security device will set the value of the third field according to the detected risk type. For example, when the security device detects that the first business message has a risk type of file type filtering, the value of the third field can be set to the sixth value, and the sixth value is used to indicate that the first business message has a risk type of file type filtering. For another example, when the security device detects that the first business message has a risk type of protocol type filtering, the value of the third field can be set to the seventh value, and the seventh value is used to indicate that the first business message has a risk type of protocol type filtering. For another example, when the security device detects that the first business message has a risk type of WEB website filtering, the value of the third field can be set to the eighth value, and the eighth value is used to indicate that the first business message has a risk type of WEB website filtering. As shown in Table 1, the sixth value is 1, the seventh value is 2, and the eighth value is 8.

[0246] For example, when the value of the second field in the detection tag information in the first service message is the fourth value and the value of the first field is the first value, after the security device performs a security check on the first service message, if the security check result of the first service message indicates that the first service message is at risk, the value of the first field in the detection tag information is set to the second value, and the value of the third field is set based on the detected risk type, thereby obtaining a second service message. If the security check result of the first service message indicates that the first service message is not at risk, the value of the first field remains the first value, and accordingly, the value of the third field remains the fifth value. In this case, the second service message obtained is the same as the first service message.

[0247] For example, when the value of the second field in the detection tag information in a first service message is the fourth value and the value of the first field is the second value, after the security device performs a security check on the first service message, if the security check result of the first service message indicates that the first service message is at risk, the value of the first field in the detection tag information remains the second value, while the value of the third field is updated based on the detected risk type, thereby obtaining a second service message. It is understood that if the security device does not detect a new risk type, the value of the third field remains unchanged, and the second service message obtained in this case is the same as the first service message.

[0248] When the value of the first field in the detection tag information in the first business message is the second value, after the security device performs a security check on the first business message, if the security check result of the first business message indicates that there is no risk to the first business message, in order to ensure business security, the detection tag information is not updated, that is, the value of the first field in the detection tag information is still the second value, and the value of the third field remains unchanged. At this time, the second business message obtained is the same as the first business message.

[0249] The embodiment of the present application updates the detection tag information based on the security detection results, so that the detection tag information can accurately indicate the risk situation of the business message, so that the network management analyzer can identify the risky business flow forwarding path based on the detection tag information in the business message, thereby ensuring the security of the business.

[0250] After receiving the second service message, the security device sends the second service message to the next-hop device on the service flow forwarding path.

[0251] As an example, the security device sends the second service message to the next-hop device on the service flow forwarding path according to the forwarding policy. Exemplarily, it includes the following (1) to (3).

[0252] (1) In response to the security detection result of the security device on the first service packet indicating that the first service packet does not pose a risk, the security device sends a second service packet to a next-hop device on the service flow forwarding path.

[0253] Among them, when the flow identification information in the first business message is different from the flow identification information of the third business message, and the first business message does not include malicious features, there is no risk to the first business message. At this time, the second business message is sent to the next-hop device on the business flow forwarding path to ensure the normal forwarding of the message.

[0254] (2) In response to the security detection result of the security device on the first service packet indicating that the first service packet has a risk, the security device sends a second service packet to the next hop device on the service flow forwarding path.

[0255] As an example, to ensure network security, when a security detection result indicates that a first service packet presents a risk, the security device sends a second service packet to the next-hop device on the service flow forwarding path. This refers to the case where the flow identification information detected in the first service packet is identical to the flow identification information of the third service packet, but the first service packet does not contain malicious features, and the second service packet is sent to the next-hop device on the service flow forwarding path. Specifically, if the first service packet belongs to a risky service flow and presents a potential threat, the second service packet is sent to the next-hop device on the service flow forwarding path.

[0256] Understandably, the value of the first field in the second service message sent at this time indicates that the second service message is at risk, and the value of the third field indicates the same risk type as the third service message. The second service message being at risk here means that the second service message belongs to a risky service flow and presents a potential threat.

[0257] As an example, during security detection, if it is detected that the flow identification information of the first business message is the same as the flow identification information of the third business message, and the first business message includes malicious features, that is, the first business message is a risky message, the obtained second business message is blocked.

[0258] As an example, during security detection, if the flow identification information of the first business message is different from the flow identification information of the third business message, but the first business message includes malicious features, that is, the first business message is a risky message, the second business message obtained is blocked.

[0259] The embodiments of the present application can improve network security by blocking business messages with malicious characteristics and prevent risky messages with threats from affecting network security.

[0260] (3) In response to the value of the second field in the detection tag information in the first service message being the fourth value and the value of the first field being the first value, the security device sends the second service message to the next-hop device on the service flow forwarding path.

[0261] If the value of the second field in the first service message is the fourth value and the value of the first field is the first value, it indicates that the first service message has been security checked and poses no risk. To save resources and reduce workload, the security device can skip security checks and directly send the second service message to the next-hop device on the service flow forwarding path. In this case, the second service message sent is identical to the first service message.

[0262] In the embodiment of the present application, when the value of the second field in the detection tag information is the fourth value and the value of the first field is the first value, the security device directly sends the second service message to the next-hop device on the service flow forwarding path, which can save resources and reduce workload.

[0263] As an example, to facilitate the security device to perform security detection on the service message, the security device records the flow identification information of each service flow through the session table, and implements security detection on the service message based on the session table.

[0264] Exemplarily, for each service flow, when the security device receives the service message of the service flow for the first time, it establishes a session table based on the service message received for the first time, and then the service message of the service flow is security checked according to the session table, and the service message forwarding process is performed through the session table.

[0265] As an example, the session table includes the following content: Current Total Sessions: 1 icmp VPN: public-->public ID:a58f3a20d0900198275d3847c2 Zone: trust-->untrust TTL:00:00:20 Left:00:00:04 Recv Interface: GigabitEthernet1 / 0 / 2 Interface: GigabitEthernet1 / 0 / 4 NextHop:1.1.1.2 MAC:707b-e8c8-0a76 <--packets:10 bytes:600-->packets:10 bytes:600 2.2.2.2.1-->1.1.1.2:2048 PolicyName:Allow Admin Ping

[0266] In the above example, Current Total Sessions is the total number of sessions in the current session table, ICMP is the protocol name in the session table, the first "public" in VPN:public-->public indicates the source VPN, the second "public" indicates the destination VPN, ID is the ID of the current session, Zone indicates the security zone, Trust indicates the source domain, and Untrust indicates the destination domain in Zone:trust-->untrust, TTL is the session table lifetime, Left is the remaining time in the session table, Recv Interface is the inbound interface, Interface is the outbound interface, NextHop is the gateway address, MAC is the next-hop MAC address, <--packets is the number of reverse packets, -->packets is the number of forward packets, 2.2.2.2.1-->1.1.1.2:2048 is the source IP address / port and destination IP address / port, and PolicyName indicates the security policy that the packet matches.

[0267] As an example, for each service flow, when the security device detects a third service message that indicates a risk in the service flow, it will mark the session table of the service flow as risky to indicate that the service flow is risky.

[0268] As an example, the security device matches the flow identification information of each received first service message with the flow identification information in the session table marked with the risk flag to detect the first service message that poses a risk. The embodiment of the present application records the flow identification information and security policy in the session table, which can facilitate security detection by the security device and improve the processing efficiency of the security device.

[0269] In some embodiments of the present application, a whitelist is provided for a specific service flow, and the whitelist includes flow identification information of the specific service flow. Upon obtaining the flow identification information of the first service message, the security device matches the flow identification information of the first service message with the flow identification information in the whitelist. If the flow identification information of the first service message is the same as the flow identification information in the whitelist, the first service message is forwarded without performing a security check, thereby improving processing efficiency. If the flow identification information of the first service message is different from the flow identification information in the whitelist, a security check is required for the first service message.

[0270] As shown in Figure 20, a schematic diagram of a detection process for a security device is shown. Upon receiving a first service message, the security device parses the frame header of the first service message, strips the frame header, and parses the IP header to obtain the detection tag information and flow identification information for the first service message. Based on the flow identification information, basic security checks such as whitelist detection and distributed denial of service (DDos) attack prevention detection are performed, and IP / MAC address binding is performed. The flow identification information is then used to match sessions and detect whether a session needs to be established. If the first service message is the first packet of a service flow and no matching session is found, the first-packet session establishment process is executed, and security checks are performed based on the security policy. If the first service message is not the first packet of a service flow and a matching session is found, the subsequent packet processing process is executed, and security checks are performed based on the security policy in the session table. Security checks include detecting whether malicious features in the malicious database are included and detecting whether the flow identification information is the same as the flow identification information of a third service message that has been detected as posing a risk. After the detection is completed, the detection tag information in the first service message is updated according to the security detection result, and the message is encapsulated based on the updated detection tag information to obtain a second service message, and the second service message is sent to the next hop device on the service flow path.

[0271] The specific process of the security device parsing the frame header, stripping the frame header, whitelisting, IP / MAC address binding, establishing a session with the first packet, and encapsulation refers to conventional technology and will not be described in detail here.

[0272] The embodiments of the present application can improve network security by performing multiple tests on service messages, including whitelist detection, distributed denial of service, attack prevention detection, and security detection. Furthermore, by updating detection tag information based on security detection results, the detection tag information can accurately indicate the risk of service messages. Thus, the network management analyzer can identify risky service flow forwarding paths based on the detection tag information in the service messages, thereby ensuring service security.

[0273] Optionally, the next-hop device of the security device is a network device. Optionally, the next-hop device of the security device is another security device.

[0274] It is understandable that when the next hop device of the security device is another security device, the processing process of the other security device refers to the above description and is not repeated here. When the next hop device of the security device is a network device, the network device is an intermediate node on the service flow forwarding path.

[0275] For ease of understanding, please refer to Figure 21, which is another flow chart of the message detection method provided in an embodiment of the present application. The method shown in Figure 21 can be applied to the service flow transmission system shown in Figure 11 and executed by a second network device. The second network device is a network device that is an intermediate node on the service flow forwarding path, such as network device R2 and network device R3 in Figure 12. As shown in Figure 21, the message detection method provided in an embodiment of the present application also includes steps S401 to S403.

[0276] S401, the second network device receives a second service message from the previous hop device on the service flow forwarding path, the message header of the second service message includes detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether the second service message has a risk.

[0277] Optionally, for the second network device that is an intermediate node, the previous hop device on the service flow forwarding path is another network device or a security device.

[0278] Exemplarily, when the second network device is the network device R2 in FIG. 12 , the previous-hop device is the network device R1 ; when the second network device is the network device R3 in FIG. 12 , the previous-hop device is the security device FW1 .

[0279] It is understandable that when the previous-hop device of the second network device is the first network device, the second service message received by the second network device is the first service message encapsulated by the first network device. When the previous-hop device of the second network device is a security device or other network device other than the first network device, the second service message is the service message obtained after forwarding and / or security checking the first service message.

[0280] In an embodiment of the present application, a message header of a second service message received by the second network device includes detection flag information. Exemplarily, an IFIT message header of the second service message received by the second network device includes detection flag information. When the second service message is an MPLS protocol message, the IFIT message header is located in the MPLS message header of the second service message. When the second service message is an SRv6 protocol message, the IFIT message header is located in an extended header (SRH) of the second service message.

[0281] In the embodiment of the present application, the detection mark signal includes a first field, and the value of the first field is used to indicate whether the second service message has a risk.

[0282] It is understandable that when the first service message encapsulated by the first network device includes the second field and the third field, the second service message received by the second network device also includes the second field and the third field. For the explanation of the second field and the third field, refer to the above explanation and are not repeated here.

[0283] When the previous-hop device of the second network device is the first network device, the values ​​of the first field, the second field, and the third field in the second service message received by the second network device are the same as the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0284] For example, if the value of the first field in the first service message encapsulated by the first network device is set to the first value, the value of the first field in the second service message received by the second network device is also the first value. If the value of the second field in the first service message encapsulated by the first network device is set to the third value, the value of the second field in the second service message received by the second network device is also the third value. If the value of the second field in the first service message encapsulated by the first network device is set to the fifth value, the value of the fifth field in the second service message received by the second network device is also the fifth value.

[0285] When the previous-hop device of the second network device is a security device or a network device other than the first network device, the values ​​of the first field, the second field, and the third field in the second service message received by the second network device may be different from the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0286] For example, if the second service message received by the second network device is a service message obtained after security detection by the previous-hop security device, the value of the second field in the second service message received by the second network device will be set to a fourth value, which indicates that the second service message has been security detected. Furthermore, if the security detection indicates a risk, the value of the first field will be set to a second value, which indicates that the second service message is at risk.

[0287] It can be understood that if the second service message received by the second network device is only obtained by forwarding the first service message encapsulated by the first network device through multiple consecutive hops of network devices, and the second service message has not been security detected, then the values ​​of the first field, the second field, and the third field in the second service message are the same as the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0288] S402: The second network device sends flow security status information to the network management analyzer. The flow security status information is used to indicate whether the second service message has a risk.

[0289] In order to detect risky service messages and risky service flow forwarding paths in a service flow, the second network device can send flow security status information of the second service message to the network management analyzer after receiving the second service message.

[0290] Accordingly, the flow security status information of the second service message is used to indicate whether the second service message is at risk. The flow security status information of the second service message refers to the flow security status information of the first service message, and is not described in detail here.

[0291] S403: The second network device sends a second service message to the next-hop device on the service flow forwarding path.

[0292] When the second network device is an intermediate node on the service flow forwarding path, the second network device also needs to send the second service message to the next-hop device so that the second service message is forwarded to the destination network node through the next-hop device.

[0293] Optionally, the next-hop device of the second network device is another network device, or a security device, which is specifically determined according to the service flow forwarding path.

[0294] When the second network device is the tail node on the service flow forwarding path, the second network device sends the second service message to the destination device.

[0295] In the embodiment of the present application, after receiving a service message, each network device uploads the flow security status information of the service message to the network management analyzer. In this way, the network management analyzer can identify risky service flow messages and risky service flow forwarding paths based on the flow security status information. The network devices include a first network device and a second network device.

[0296] In order to obtain the risk status of the service flow in a timely manner, in some embodiments of the present application, each network device uses telemetry to report the flow security status information to the network management analyzer.

[0297] Using telemetry technology, each network device periodically and proactively reports the flow security status of service packets to the network management analyzer in a push mode. Telemetry technology can collect data at a sub-second rate. Therefore, each network device uploads this flow security status information to the network management analyzer through telemetry, enabling the analyzer to promptly identify risky service packets and forwarding paths within the service flow.

[0298] Exemplarily, the network management analyzer and the network device pre-subscribe to the data information that needs to be collected, such as the flow security status information in the embodiment of the present application. Then, the network device uses the flow security status information in the service message according to the subscription requirements, and then encodes the collected flow security status information and actively uploads it to the network management analyzer.

[0299] As an example, the network device uses GPB (Google Protocol Buffers) encoding format to encode the flow security status information, and then uploads the encoding result to the network management analyzer. The GPB encoding format is a binary encoding. Through GPB encoding, data collection efficiency can be improved.

[0300] As an example, the network device uploads the encoded stream security status information to the network management analyzer based on the Google Remote Procedure Call (gRPC) method. As an example, the network device uploads the encoded stream security status information to the network management analyzer based on the User Datagram Protocol (UDP) method. In this way, for different business scenarios, matching upload methods can be used to achieve the collection of stream security status information.

[0301] To reduce transmission volume and transmission load, in an embodiment of the present application, each network device uploads the flow security status information of a service message when the first field of the service message indicates that the service message is at risk. For example, after receiving a service message, the network device identifies the detection tag information in the service message. If the first field in the detection tag information indicates that the service message is at risk, the flow security status information of the service message is uploaded to the network management analyzer. If the first field in the detection tag information indicates that the service message is not at risk, there is no need to upload the flow security status information of the service message to the network management analyzer.

[0302] To facilitate the network management analyzer's timely identification of risky service flow forwarding paths, in some embodiments of the present application, the flow security status information also includes the network device's identifier. Thus, after each network device sends the flow security status information to the network management analyzer, the network management analyzer can identify risky service flow forwarding paths and path segments within risky service flow forwarding paths based on the network device's identifier, flow identification information, and detection tag information.

[0303] For ease of understanding, please refer to Figure 22, which is another flow chart of a message detection method provided in an embodiment of the present application. The method shown in Figure 22 can be applied to the service flow transmission system shown in Figure 11 and executed by a network management analyzer, for example, the network management analyzer shown in Figure 12. As shown in Figure 22, the message detection method provided in an embodiment of the present application further includes steps S501 to S502.

[0304] S501, a network management analyzer receives flow security status information from a network device, the flow security status information including flow identification information and detection tag information of a service message, the detection tag information including a first field, the value of the first field being used to indicate whether the service message has a risk.

[0305] The network management analyzer receives the flow security status information sent by each network device, and the flow security status information includes flow identification information and detection mark information of the service message.

[0306] The detection flag information includes a first field, the value of which indicates whether the service message is at risk. The detection flag information also includes a second field and a third field. The second field indicates whether the service message has been security-checked, and the third field indicates the risk type if the service message is at risk.

[0307] In an embodiment of the present application, the flow security status information also includes an identifier of the network device, and each network device has a unique identifier.

[0308] S502. When the value of the first field indicates that the service message is at risk, the network management analyzer outputs an alarm message. The alarm message includes an identifier of the service flow forwarding path at risk, or an identifier of some nodes in the service flow forwarding path at risk. The identifier of the service flow forwarding path at risk is determined based on the flow identification information.

[0309] The alarm information includes an identifier of a risky business flow forwarding path, or identifiers of some nodes in the risky business flow forwarding path.

[0310] In an embodiment of the present application, the identification of the risky business flow forwarding path is determined based on the flow identification information. Exemplarily, a network topology relationship diagram is stored in the network management analyzer. For each business flow forwarding path in the network topology, the network management analyzer stores the flow identification information of the business flow transmitted by the business flow forwarding path, that is, the network management analyzer stores the mapping relationship between the identification of each business flow forwarding path and the flow identification information of the corresponding business flow. Therefore, when the network management analyzer receives the flow security status information, if the value of the first field in the detection tag information in the flow security status information indicates that the business message is at risk, the network management analyzer obtains the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information based on the mapping relationship. After obtaining the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information, it is determined that the business flow forwarding path corresponding to the flow identification information in the flow security status information is at risk, and an alarm prompt is issued, and the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information is output.

[0311] In some embodiments of the present application, the flow security status information uploaded by the network device to the network management analyzer includes the network device's own identification. Thus, upon receiving the flow security status information from the network device, if the value of the first field in the detection flag information in the flow security status information indicates that a service packet is at risk, the network management analyzer issues an alarm based on the network device's identification and outputs the network device's identification.

[0312] In some embodiments of the present application, the network management analyzer also stores the identifier of each node in the network topology diagram. When the network management analyzer receives the flow security status information of the network device, if the value of the first field in the detection tag information in the flow security status information indicates that the service message is at risk, the network management analyzer obtains the risky service flow forwarding path based on the mapping relationship and the flow identification information in the flow security status information, and then matches the identifier of the network device that uploaded the flow security status information with the identifier of the node on the service flow forwarding path to obtain the risky section on the service flow forwarding path. Then, an alarm prompt is issued based on the risky section, and the identifier of the node in the risky section is output.

[0313] In some embodiments of the present application, the flow security status information uploaded by the network device to the network management analyzer also includes flow detection data. After receiving the flow detection data, the network management analyzer obtains the packet loss and delay of the service flow based on the flow detection data.

[0314] In some embodiments of the present application, when the value of the first field in the detection tag information in the flow security status information indicates that there is a risk in the business message, the network management analyzer determines that the business message discarded in the risk section is discarded due to the risk after determining the risk section, and then outputs a packet loss prompt, which includes a discard description of the discarded business message.

[0315] The embodiment of the present application sets detection mark information in the service message and indicates the risk of the service message based on the detection mark information. In this way, after receiving the flow security status information, the network management analyzer can identify the risky service flow forwarding path based on the detection mark information in the flow security status information, thereby ensuring the security of the service.

[0316] The following describes the packet detection method provided by the embodiment of the present application, taking the service flow forwarding path shown in Figure 12, where the detection tag information includes the first field, the second field, and the third field, as an example, combined with the detection tag information shown in Table 1. As shown in Figure 23, hop-by-hop flow detection is deployed for each network device.

[0317] First, network device R1 encapsulates the service flow data to be transmitted, generating a service message. At this point, the detection flag information in the service message contains the values ​​of 0 in the first, second, and third fields. The detection flag information in the service message is represented as 0-0-0 (the values ​​of the second, first, and third fields, respectively). Network device R1 then sends flow security status information to the network management analyzer and the service message to network device R2. At this point, the detection flag information in the flow security status information received by the network management analyzer is 0-0-0, and the network management analyzer does not process it.

[0318] Network device R2 forwards the service packet to security device FW1 and sends the flow security status information to the network management analyzer. At this point, the detection flag information in the flow security status information received by the network management analyzer is still 0-0-0, and the network management analyzer does not process it. Accordingly, the detection flag information in the service packet forwarded to security device FW1 is also 0-0-0.

[0319] After receiving the service message, security device FW1 performs a security check on the service message. If no risk is detected, the second field in the detection flag information in the service message is set to 1. The detection flag information in the service message is now 1-0-0. Security device FW1 sends the service message with the detection flag information 1-0-0 to network device R3.

[0320] After receiving the service packet from security device FW1, network device R3 sends flow security status information to the network management analyzer and forwards the received service packet to security device FW2. At this point, the detection flag in the flow security status information received by the network management analyzer is 1-0-0, so the network management analyzer does not process it. Accordingly, the detection flag in the service packet forwarded to security device FW2 also has 1-0-0.

[0321] After security device FW2 receives the service message forwarded by network device R3, it performs a security check on the service message and detects that the service message is at risk of file filtering. Security device FW2 sets the first field of the detection tag information in the service message to 1 and the third field to 1. At this time, the detection tag information in the service message is 1-1-1.

[0322] After the security device FW2 detects that the service message has the risk of file filtering, the security device FW2 blocks the service message and sets the first field of the detection tag information in the service message with the same flow identification information but no malicious features to 1 and the third field to 1.

[0323] Security device FW2 sends a service message with detection tag information 1-1-1 to network device R4.

[0324] After receiving the service packet from security device FW2, network device R4 sends the flow security status information to the network management analyzer. At this point, the detection flag information in the flow security status information received by the network management analyzer is 1-1-1. The network management analyzer then marks the service flow forwarding path as risky, or the path segment from network device R3 to network device R4 as risky, and outputs an alarm message to indicate a security detection anomaly. The alarm message includes the identifier of the service flow forwarding path, or the identifiers of network devices R3 and R4.

[0325] The device detection method provided in the embodiment of the present application can assist in identifying risky messages and / or risky paths in the business flow at the management and control analysis layer by setting detection mark information in the message and indicating the risk of the message through the detection mark information.

[0326] Based on the same inventive concept, an embodiment of the present application further provides a security device. FIG24 is a schematic structural diagram of a security device 100 provided in an embodiment of the present application. The security device 100 shown in FIG24 is, for example, the security device in the embodiments corresponding to FIG18 , FIG19 , and FIG20 , or the security device FW1 and the security device FW2 in FIG12 .

[0327] As shown in Figure 24, the security device 100 includes a receiving unit 101 and a sending unit 102; wherein, the receiving unit 101 is used to receive a first business message from the previous hop device on the business flow forwarding path, and the message header of the first business message includes detection mark information, and the detection mark information includes a first field, and the first field is used to indicate whether the first business message has a risk; the sending unit 102 is used to send a second business message to the next hop device on the business flow forwarding path, wherein the second business message is the same as the first business message, or the second business message is obtained by updating the value of the first field in the first business message.

[0328] Optionally, if the value of the first field in the first business message is a second value, the second value indicates that there is a risk in the first business message, and the sending unit 102 is used to: send a second business message to the next hop device on the business flow forwarding path, and the first business message is the same as the second business message.

[0329] Optionally, the security device 100 further includes a security detection unit 103; if the value of the first field in the first service message is a first numerical value, the first numerical value indicates that the first service message does not pose a risk, and before sending the second service message to a next-hop device on the service flow forwarding path, the security detection unit 103 is configured to: the security device perform a security check on the first service message.

[0330] The sending unit 102 is used to: in response to the security detection result of the security device on the first business message indicating that the first business message does not pose a risk, send a second business message to the next-hop device on the business flow forwarding path, where the first business message is identical to the second business message; in response to the security detection result of the security device on the first business message indicating that the first business message poses a risk, send a second business message to the next-hop device on the business flow forwarding path, where the second business message is obtained by updating the value of the first field of the first business message to a second value, and the second value indicates that the second business message poses a risk.

[0331] Optionally, the detection mark information in the first business message also includes a second field, and the value of the second field is used to indicate whether the first business message has been security detected; the security detection unit 103 is used to: in response to the value of the second field in the detection mark information in the first business message being a third numerical value, the third numerical value indicates that the first business message has not been security detected, the security device performs security detection on the first business message.

[0332] Before sending the second service message to the next-hop device on the service flow forwarding path, the security detection unit 103 is also used to: update the value of the second field of the first service message to a fourth value, the fourth value indicating that the first service message has been security detected, thereby obtaining the second service message.

[0333] Optionally, before performing security detection on the first service message, the security detection unit 103 is further configured to:

[0334] In response to the value of the second field in the detection flag information in the first service message being the fourth value, the security detection unit 103 omits the step of performing security detection on the first service message.

[0335] Optionally, the security detection unit 103 is used to: determine whether the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk; in response to the flow identification information of the first business message being the same as the flow identification information of the third business message that has been detected to be at risk, determine that the security detection result of the first business message indicates that the first business message is at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk, determine whether the first business message includes malicious features in the malicious feature library; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk by the security device, and the first business message does not include malicious features in the malicious feature library, determine that the security detection result of the first business message indicates that the first business message is not at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk by the security device, and the first business message includes malicious features in the malicious feature library, determine that the security detection result of the first business message indicates that the first business message is at risk.

[0336] Optionally, the flow identification information includes one or more of the following: source end address information, destination end address information, source end port number, destination end port number, and protocol type.

[0337] Optionally, the detection mark information further includes a third field, and the value of the third field is used to indicate the risk type of the risk when there is a risk in the first service message.

[0338] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0339] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

[0340] Optionally, the first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0341] Optionally, the first service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the first service packet; or, the first service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the first service packet.

[0342] Please refer to Figure 25, which is a schematic diagram of the structure of a security device provided in an embodiment of the present application. The security device 100 shown in Figure 25 is, for example, the security device in the embodiments corresponding to Figures 18, 19, and 20, or the security device FW1 and the security device FW2 in Figure 12.

[0343] As shown in Figure 25, security device 200 includes a processor 201, a memory 202, and a network interface 203. The processor 201, the memory 202, and the network interface 203 are connected via a double data rate (DDR) bus or other types of buses. The network interface 203 is used to communicate with other devices. For example, the network interface 203 receives service messages sent by a network device or other security device, or sends service messages to a network device or other security device via the network interface.

[0344] Processor 201 may be a central processing unit (CPU) or other specific integrated circuit. Processor 201 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. In practical applications, a security device may also include multiple processors, each of which may include one or more processor cores.

[0345] Memory 202 is typically used to store executable computer program code. Executable program code includes instructions. Processor 201 executes the instructions stored in memory to execute various functional applications and data processing functions of security device 200. Memory 202 includes a program storage area and a data storage area. The program storage area can store the operating system and at least one application required for a function, while the data storage area can store data generated during the use of security device 200.

[0346] In addition, the memory 202 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0347] It is understood that the structure shown in FIG25 of the present application does not constitute a specific limitation on the security device 200. In other embodiments of the present application, the security device 200 may include more or fewer components than shown in the figure, or combine or separate certain components, or arrange the components differently, and the components may be implemented in hardware, software, or a combination of software and hardware.

[0348] Please refer to Figure 26, which is a schematic diagram of the structure of a network device 300 provided in an embodiment of the present application. The network device 300 shown in Figure 26 is, for example, the first network device in the embodiment corresponding to Figure 14 above, or the network device R1 in Figure 12.

[0349] As shown in Figure 26, network device 300 includes a processing unit 301 and a sending unit 302. Processing unit 301 is configured to encapsulate service flow data to be transmitted, thereby obtaining a first service message. The message header of the first service message includes detection flag information, which includes a first field whose value is set to a first value, indicating that the first service message is not risk-free. Sending unit 302 is configured to send the first service message to the next-hop device on the service flow forwarding path. Optionally, the detection flag information also includes a second field whose value is set to a third value, indicating that the first service message has not been security-detected.

[0350] Optionally, the detection mark information further includes a third field, the value of the third field is set to a fifth numerical value, and the fifth numerical value is used to indicate that the risk type of the first service message is to be set.

[0351] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0352] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

[0353] Optionally, the first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0354] Optionally, the first service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the first service packet; or, the first service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the first service packet.

[0355] Optionally, the sending unit 302 is further configured to send flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message is at risk.

[0356] Optionally, the flow security status information includes flow identification information and detection mark information of the first service message.

[0357] Please refer to Figure 27, which is a schematic diagram of the structure of a network device 400 provided in an embodiment of the present application. The network device 400 shown in Figure 27 is, for example, the second network device in the embodiment corresponding to Figure 21 above, or the network device R2, network device R3, or network device R4 in Figure 12.

[0358] As shown in Figure 27, the network device 400 includes a receiving unit 401 and a sending unit 402, wherein the receiving unit 401 is used to receive a second service message from the previous-hop device on the service flow forwarding path, and the message header of the second service message includes detection mark information, and the detection mark information includes a first field, and the value of the first field is used to indicate whether the second service message is at risk; the sending unit 402 is used to send flow security status information to the network management analyzer, and the flow security status information is used to indicate whether the second service message is at risk.

[0359] Optionally, the detection mark information further includes a second field, and the value of the second field is used to indicate whether the second service message has been security detected.

[0360] Optionally, the detection mark information further includes a third field, and the value of the third field is used to indicate the risk type of the risk when there is a risk in the second service message.

[0361] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0362] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, it is convenient for service messages to carry detection mark information and realize the identification of risky service flow forwarding paths.

[0363] Optionally, the second service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0364] Optionally, the second service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the second service packet; or, the second service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the second service packet.

[0365] Optionally, the flow security status information includes flow identification information and detection mark information of the second service message.

[0366] Optionally, the sending unit 402 is further configured to: in response to the second network device being an intermediate node on the service flow forwarding path, send the second service message to a next-hop device on the service flow forwarding path.

[0367] Referring to Figure 28, Figure 28 is a schematic diagram of the structure of a network device 500 provided in an embodiment of the present application. Among them, the network device 500 shown in Figure 28 can be used to execute the steps performed by any one of the first network device and the second network device described in the above embodiment. Although the network device 500 shown in Figure 28 shows certain specific features, those skilled in the art will realize from the embodiments of the present application that, for the sake of brevity, Figure 28 does not show various other features to avoid confusing more relevant aspects of the implementation methods disclosed in the embodiments of the present application. To this end, as an example, in some implementations, the network device 500 includes one or more processors (such as CPUs) 501, a network interface 502, a memory 503, and one or more communication buses 504 for interconnecting various components. In other implementations, the network device 500 can also omit or add some functional components or units based on the above examples.

[0368] In some implementations, the network interface 502 is used to connect to other network devices / security devices. In some implementations, the communication bus 505 includes circuits for interconnecting and controlling communications between system components. The memory 503 can include non-volatile memory or volatile memory.

[0369] In some implementations, the non-transitory computer-readable storage medium of memory 503 stores the following programs, modules, and data structures, or a subset thereof, including, for example, a processing unit (not shown in the figure), a sending unit (not shown in the figure), and a receiving unit (not shown in the figure).

[0370] In a possible embodiment, the network device 500 has any functions of the network devices in the method embodiments corresponding to FIG. 14 and FIG. 21 .

[0371] It should be understood that in this application, the network interface 502 on the network device 500 can complete the data sending and receiving operations, or the processor 501 can call the program code in the memory and cooperate with the network interface 502 to implement the data sending and receiving operations when necessary.

[0372] Optionally, the specific structure of the network device described in Figure 28 of this application is shown in Figure 29.

[0373] Figure 29 is a schematic diagram of the structure of a network device 600 provided in an embodiment of the present application. The network device 600 shown in Figure 29 can be used to execute the steps performed by either the first network device or the second network device described in the above embodiments. The network device 600 includes a main control board 601 and an interface board 602.

[0374] Main control board 601, also known as the main processing unit (MPU) or route processor, is used to control and manage various components in network device 600, including routing calculation, device management, device maintenance, and protocol processing. Main control board 601 includes a central processing unit (CPU) 6011 and memory 6012.

[0375] Interface board 602 is also known as a line processing unit (LPU), line card, or service board. It provides various service interfaces and implements data packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and POS (Packet over SONET / SDH) interfaces. Interface board 602 includes a central processing unit (CPU) 6021, a network processor (NPU) 6022, a physical interface card (PIC) 6023, and a forwarding table memory 6024.

[0376] The central processing unit 6021 on the interface board 602 is used to control and manage the interface board 602 and communicate with the central processing unit 6011 on the main control board 601 .

[0377] The network processor 6022 is used to implement packet forwarding processing and can be in the form of a forwarding chip.

[0378] The physical interface card 6023 implements the physical layer interconnection function. Raw traffic enters the interface board 602 through this card, and processed packets are sent out from this physical interface card 6023. The physical interface card 6023 includes at least one physical interface, also known as a physical port. This physical interface can be a Flexible Ethernet (FlexE) physical interface. In some embodiments, the central processing unit 6021 of the interface board 602 can also perform the functions of the network processor 6022, such as implementing software forwarding based on a general-purpose CPU. This eliminates the need for a network processor 6022 in the interface board 602.

[0379] Optionally, the network device 600 includes multiple interface boards. For example, the network device 600 further includes an interface board 603 . The interface board 603 includes a central processing unit 6031 , a network processor 6032 , a physical interface card 6033 , and a forwarding table entry memory 6034 .

[0380] Optionally, the network device 600 further includes a switching fabric board 604. The switching fabric board 604 can also be referred to as a switch fabric unit (SFU). If the network device has multiple interface boards 602, the switching fabric board 604 is used to exchange data between the interface boards. For example, the interface board 602 and the interface board 603 can communicate via the switching fabric board 604.

[0381] The main control board 601 is coupled to the interface board. For example, the main control board 601, the interface board 602, the interface board 603, and the switching network board 604 are interconnected via a system bus and / or a system backplane. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 601 and the interface board 602, and communication between the main control board 601 and the interface board 602 is performed via the IPC channel.

[0382] Logically, network device 600 includes a control plane and a forwarding plane. The control plane includes a main control board 601 and a central processing unit (CPU) 6021. The forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 6024, physical interface cards 6023, and network processing units 6022. The control plane performs functions such as publishing routes, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining device status. The control plane sends the generated forwarding tables to the forwarding plane. On the forwarding plane, the network processing unit 6022 forwards messages received by the physical interface card 6023 based on the forwarding tables sent by the control plane. The forwarding tables sent by the control plane can be stored in the forwarding table entry memory 6024. In some embodiments, the control plane and forwarding plane can be completely separate and not located on the same device.

[0383] It should be understood that the operations on interface board 603 in the embodiment of the present application are consistent with those on interface board 602, and for the sake of brevity, detailed description thereof will not be repeated. It should be understood that network device 600 in this embodiment may correspond to the first network device in each of the above-mentioned method embodiments, and the main control board 601, interface board 602, and / or interface board 603 in network device 600 may implement the functions and / or various steps performed by the first network device in each of the above-mentioned method embodiments, and for the sake of brevity, detailed description thereof will not be repeated here.

[0384] It's worth noting that there may be one or more main control boards (SBCs). Multiple SBCs can include a primary and a backup SBC. There may be one or more interface boards. The higher the network device's data processing capabilities, the more interface boards it provides. An interface board can also have one or more physical interface cards. There may be no SBCs, or one or more. Multiple SBCs can be used to achieve load balancing and redundancy. In a centralized forwarding architecture, a network device may not require a SBC; the interface board handles service data processing for the entire system. In a distributed forwarding architecture, a network device may have at least one SBC, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Alternatively, a network device can have only one SBC, i.e., without a SBC. The functions of the interface board and the SBC are integrated on this single card. In this case, the central processing unit (CPU) on the interface board and the CPU on the SBC can be combined into a single CPU on this single card to perform the combined functions. The specific architecture used depends on the specific network deployment scenario and is not intended to be exclusive here.

[0385] It should be understood that the network devices in the various product forms mentioned above respectively have any functions of the first network device and the second network device in the above method embodiments, which will not be described in detail here.

[0386] Please refer to Figure 30, which is a schematic diagram of the structure of a network management analyzer 700 provided in an embodiment of the present application. The network management analyzer 700 shown in Figure 30 is, for example, the first network device in the embodiment corresponding to Figure 22 above, or the network management analyzer in Figure 12.

[0387] As shown in Figure 30, the network management analyzer 700 includes a receiving unit 701 and an alarm unit 702, wherein the receiving unit 701 is used to receive flow security status information from a network device, the flow security status information includes flow identification information of a service message, and detection tag information, the detection tag information includes a first field, the value of the first field is used to indicate whether the service message is at risk; the alarm unit 702 is used to output alarm information when the value of the first field indicates that the service message is at risk, the alarm information includes an identifier of a risky service flow forwarding path, or an identifier of some nodes in a risky service flow forwarding path. The identifier of a risky service flow forwarding path is determined based on the flow identification information. Please refer to Figure 31, which is a structural schematic diagram of a network management analyzer 800 provided in an embodiment of the present application. The network management analyzer 800 shown in Figure 31 is, for example, the first network device in the embodiment corresponding to Figure 22 above, or the network management analyzer in Figure 12.

[0388] As shown in FIG31 , the network management analyzer 800 includes a network interface 801 , a processor 802 , and a memory 803 .

[0389] The network interface 801 is used to communicate with other devices. For example, the network interface 801 can receive flow security status information uploaded by a network device.

[0390] Memory 803 is typically used to store computer program executable code. Executable code includes instructions. Processor 802 executes the instructions stored in memory to execute various functional applications and data processing of network management analyzer 800. Memory 803 can include a program storage area and a data storage area. The program storage area can store the operating system and at least one application required for a function, while the data storage area can store data generated during the use of network management analyzer 800.

[0391] It is understood that the structures listed in this application do not constitute a specific limitation on the network management analyzer 800. In other embodiments of this application, the network management analyzer 800 may include more or fewer components than shown in the figure, or combine or split some components, or arrange the components differently, and the components may be implemented in hardware, software, or a combination of software and hardware.

[0392] In addition, embodiments of the present application further provide an electronic device. The electronic device includes a memory and a processor in communication with the memory. The memory includes computer-readable instructions; the processor is configured to execute the computer-readable instructions, causing the electronic device to perform the methods performed by the security device, network device, or network management analyzer in the above embodiments.

[0393] In addition, an embodiment of the present application also provides a service flow transmission system, including one or more security devices, one or more network devices and a network management analyzer; the security devices, network devices and network management analyzer are used to execute the methods in the above embodiments.

[0394] An embodiment of the present application further provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processing circuit, the functions or steps in the above-mentioned message detection method are implemented.

[0395] In addition, an embodiment of the present application can also provide a chip system, which includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions. When the computer program instructions are executed by the processing circuit, the functions or steps in the above-mentioned message detection method are implemented.

[0396] In addition, an embodiment of the present application may also provide a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the functions or steps in the above-mentioned message detection method.

[0397] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working processes of the chip system, electronic device, computer-readable storage medium, computer program product containing instructions, and business flow transmission system described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0398] It is understandable that the steps of the method or algorithm described in conjunction with the embodiments of the present application can be implemented in a hardware manner, or can be implemented by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory, a flash memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a read-only optical disc, or any other form of storage medium. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). In addition, the ASIC can be located in an electronic device. Of course, the processor and the storage medium can also be present in an electronic device as discrete components.

[0399] In an optional manner, when software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is implemented in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)).

[0400] The above description is merely a specific implementation of the embodiments of the present application, but the scope of protection of the embodiments of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of the present application shall be included in the scope of protection of the embodiments of the present application. Therefore, the scope of protection of the embodiments of the present application shall be based on the scope of protection of the claims.

Claims

1. A message detection method, characterized in that: The method comprises: The security device receives a first service message from a previous-hop device on a service flow forwarding path, wherein a message header of the first service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is used to indicate whether the first service message has a risk; The security device sends a second service message to a next-hop device on the service flow forwarding path, wherein the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

2. The message detection method according to claim 1, characterized in that: If the value of the first field in the first service message is a second value, and the second value indicates that the first service message is at risk, the security device sends the second service message to a next-hop device on the service flow forwarding path, including: The security device sends the second service message to a next-hop device on the service flow forwarding path, where the first service message is the same as the second service message.

3. The message detection method according to claim 1, characterized in that: If the value of the first field in the first service message is a first value, and the first value indicates that the first service message does not have a risk, before the security device sends the second service message to the next hop device on the service flow forwarding path, the method further includes: The security device performs security detection on the first service message; The security device sends a second service message to a next-hop device on the service flow forwarding path, including: In response to the security detection result of the security device on the first service message indicating that the first service message does not have a risk, the security device sends a second service message to a next-hop device on the service flow forwarding path, where the first service message is the same as the second service message; In response to the security detection result of the security device on the first business message indicating that the first business message is at risk, the security device sends a second business message to the next-hop device on the business flow forwarding path, where the second business message is obtained by updating the value of the first field of the first business message to a second value, and the second value indicates that the second business message is at risk.

4. The message detection method according to claim 3, characterized in that: The detection mark information in the first service message further includes a second field, and a value of the second field is used to indicate whether the first service message has been security detected; The security device performs security detection on the first service message, including: In response to the value of the second field in the detection mark information in the first service message being a third value, the third value indicating that the first service message has not been security detected, the security device performing the security detection on the first service message; Before the security device sends the second service message to the next-hop device on the service flow forwarding path, the method further includes: The value of the second field of the first service message is updated to a fourth value, where the fourth value indicates that the first service message has been security detected, thereby obtaining the second service message.

5. The message detection method according to claim 4, characterized in that: Before the security device performs security detection on the first service message, the method further includes: In response to the value of the second field in the detection mark information in the first service message being the fourth value, the security device omits the step of performing security detection on the first service message.

6. The message detection method according to any one of claims 2 to 5, characterized in that: The security device performs security detection on the first service message, including: The security device determines whether the flow identification information of the first service message is the same as the flow identification information of the third service message with risk that has been detected by the security device; In response to the flow identification information of the first service message being the same as the flow identification information of the third service message that has been detected by the security device as being at risk, the security device determines that the security detection result of the first service message indicates that the first service message is at risk; In response to the flow identification information of the first service message being different from the flow identification information of the third service message with risk that has been detected by the security device, the security device determines whether the first service message includes a malicious feature in a malicious feature library; In response to the flow identification information of the first service message and the flow of the third service message with risk detected by the security device, The identification information is different, and the first service message does not include a malicious feature in the malicious feature library, and the security detection result of determining the first service message indicates that the first service message does not have a risk; In response to the fact that the flow identification information of the first business message is different from the flow identification information of the third business message that the security device has detected as risky, and the first business message includes malicious features in a malicious feature library, the security detection result of determining the first business message indicates that the first business message is risky.

7. The message detection method according to claim 6, characterized in that: The flow identification information includes one or more of the following: address information of the source end, address information of the destination end, port number of the source end, port number of the destination end, and protocol type.

8. The message detection method according to any one of claims 1 to 7, characterized in that: The detection mark information also includes a third field, and a value of the third field is used to indicate a risk type of the risk when the first service message has a risk.

9. The message detection method according to claim 8, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

10. The message detection method according to any one of claims 8 to 9, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

11. The message detection method according to any one of claims 1 to 10, characterized in that: The first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

12. The message detection method according to claim 11, characterized in that: The first service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the first service message; or, The first service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message.

13. A message detection method, characterized in that: The method comprises: The first network device encapsulates the service flow data to be transmitted, thereby obtaining a first service message, wherein a message header of the first service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is set to a first value, and the first value is used to indicate that there is no risk in the first service message; The first network device sends the first service message to a next-hop device on a service flow forwarding path.

14. The message detection method according to claim 13, characterized in that: The detection mark information also includes a second field, the value of the second field is set to a third value, and the third value is used to indicate that the first service message has not been security detected.

15. The message detection method according to claim 13 or 14, characterized in that: The detection mark information also includes a third field, the value of the third field is set to a fifth value, and the fifth value is used to indicate that the risk type of the first service message is to be set.

16. The message detection method according to claim 15, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

17. The message detection method according to any one of claims 13 to 16, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

18. The message detection method according to any one of claims 13 to 17, characterized in that: The first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

19. The message detection method according to claim 18, characterized in that: The first service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the first service message; or, The first service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message.

20. The message detection method according to any one of claims 13 to 19, characterized in that: The method further comprises: The first network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message has a risk.

21. The message detection method according to claim 20, characterized in that: The flow security status information includes flow identification information of the first service message and the detection mark information.

22. A message detection method, characterized in that: The method comprises: The second network device receives a second service message from a previous-hop device on a service flow forwarding path, wherein a message header of the second service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is used to indicate whether the second service message has a risk; The second network device sends the flow security status information to the network management analyzer, and the flow security status information is used to indicate that the second business Check whether there is any risk in the service message.

23. The message detection method according to claim 22, characterized in that: The detection mark information also includes a second field, and a value of the second field is used to indicate whether the second service message has been security detected.

24. The message detection method according to claim 22 or 23, characterized in that: The detection mark information also includes a third field, and a value of the third field is used to indicate a risk type of the risk when the second service message has a risk.

25. The message detection method according to claim 24, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

26. The message detection method according to any one of claims 22 to 25, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

27. The message detection method according to any one of claims 22 to 26, characterized in that: The second service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

28. The message detection method according to claim 27, characterized in that: The second service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the second service message; or, The second service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the second service message.

29. The message detection method according to any one of claims 22 to 28, characterized in that: The flow security status information includes flow identification information of the second service message and the detection mark information.

30. The message detection method according to any one of claims 22 to 29, characterized in that: The method further comprises: In response to the second network device being an intermediate node on the service flow forwarding path, the second network device sends the second service message to a next-hop device on the service flow forwarding path.

31. A message detection method, characterized in that: The method comprises: The network management analyzer receives flow security status information from the network device, wherein the flow security status information includes flow identification information of the service message and detection mark information, wherein the detection mark information includes a first field, and a value of the first field is used to indicate whether the service message has a risk; When the value of the first field indicates that the business message is at risk, an alarm message is output, wherein the alarm message includes an identifier of the business flow forwarding path at risk, or an identifier of some nodes in the business flow forwarding path at risk, wherein the identifier of the business flow forwarding path at risk is determined based on the flow identification information.

32. An electronic device, characterized in that: include: a memory for storing computer program instructions; A processor, used to execute the computer program instructions to support the electronic device to implement the method as described in any one of claims 1-12, or to implement the method as described in any one of claims 13-21, or to implement the method as described in any one of claims 22-30, or to implement the method as described in claim 31.

33. A service flow transmission system, characterized in that: It includes one or more security devices, one or more network devices and a network management analyzer; the security device is used to execute the method described in any one of claims 1-12, the network device is used to execute the method described in any one of claims 13-21 or the method described in any one of claims 22-30, and the network management analyzer is used to execute the method described in claim 31.

34. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processing circuit, implement the method as described in any one of claims 1 to 12, or the method as described in any one of claims 13 to 21, or the method as described in any one of claims 22 to 30, or the method as described in claim 31.

35. A chip system, characterized in that: The chip system includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, they implement the method as described in any one of claims 1 to 12, or the method as described in any one of claims 13 to 21, or the method as described in any one of claims 22 to 30, or the method as described in claim 31.

36. A computer program product comprising instructions, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 21, or the method according to any one of claims 22 to 30, or the method according to claim 31.

Images