Method, device and system for message transmission

Abstract

Embodiments of the present invention relate to methods, devices and systems for message transmission. The method includes a first network device establishing a MACSec channel with a second network device according to a MACSec protocol; the first network device sends an ACP message to the second network device through the MACSec channel, and the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message. The method, device and system for message transmission of the embodiments of the present invention establish a MACSec channel between adjacent nodes in a self-organizing network according to the MACSec protocol, and transmit and process ACP messages between adjacent nodes through the MACSec channel, thereby eliminating the need to configure a routable interface address and a link-local address for establishing IPSec on the interface at the same time, and providing a MACSec security mechanism for ACP without the need to use an L3 tunnel, thereby improving efficiency.

Description

[0001] This application is a divisional application of an application filed with the China Intellectual Property Office with an application date of July 17, 2015, application number 201580001609.3, and invention name “Message Transmission Method, Device and System”. Technical Field

[0002] The present invention relates to the field of communications, and in particular to a method, device and system for message transmission. Background Art

[0003] Self-organizing networks support self-management, which can reduce administrator intervention and improve the degree of network automation, thereby alleviating network management workload, facilitating the deployment of new services, reducing the probability of configuration errors, and reducing operating expenses (Operating Expense, referred to as "OPEX").

[0004] An important aspect of self-organizing networks is that devices can be "plug and play" and support self-bootstrapping and self-configuration. One of the key technologies is the establishment of an automatic control plane (Autonomic Control Plane, "ACP" for short). Its characteristics are that it does not require administrator participation, and this control plane is automatically generated and grows (new devices are automatically added); end-to-end connections are established completely "zero-touch", and ACP is not affected by administrator's incorrect configuration, thus achieving secure information interaction.

[0005] The establishment of ACP in the existing solution depends on IPv6, while most devices in the existing network support IPv4. The development of ACP based on IPv4 will have better compatibility with the existing network and can reduce deployment barriers. If you consider using a link-local-IP (169.254.0.0 / 16) similar to IPv6 to establish a secure tunnel, when establishing an ACP with an IPSec channel based on IPv4, you need to use an IPv4 link-local address. However, unlike IPv6, Request For Comments RFC (Request For Comments) 3927 recommends using an IPv4 link-local address only when there is no routable IPv4 interface address. Therefore, there is usually no Layer 3 tunnel corresponding to the link-local-IP in IPv6 available at this time, and it is impossible to establish an ACP with an IPSec channel based on IPv4. Summary of the invention

[0006] The present invention provides a message transmission method, device and system, which can improve efficiency.

[0007] In a first aspect, a method for message transmission is provided, which is applied in a self-organizing network, and the method includes: a first network device establishes a MACSec channel with a second network device according to a media access control security MACSec protocol; the first network device sends a self-organizing control plane ACP message to the second network device through the MACSec channel, and the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message.

[0008] In combination with the first aspect, in an implementation manner of the first aspect, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0009] In combination with the first aspect and the above implementation manner, in another implementation manner of the first aspect, the identification information is carried in a flag bit field in a frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0010] In combination with the first aspect and the above implementation manner, in another implementation manner of the first aspect, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0011] In a second aspect, a method for message transmission is provided, which is applied in a self-organizing network, and the method includes: a second network device establishes a MACSec channel with a first network device according to a media access control security MACSec protocol; the second network device receives a MACSec frame sent by the first network device through the MACSec channel; the second network device determines the ACP message based on identification information carried in the frame header of the MACSec frame for identifying the self-organizing control plane ACP message.

[0012] In combination with the second aspect, in an implementation manner of the second aspect, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0013] In combination with the second aspect and the above-mentioned implementation manner, in another implementation manner of the second aspect, the identification information is carried in a flag bit field in the frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0014] In combination with the second aspect and the above implementation manner, in another implementation manner of the second aspect, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0015] According to a third aspect, a first network device for message transmission is provided, which is used in a self-organizing network. The first network device includes: an establishment module, which is used for the first network device to establish a MACSec channel with a second network device according to a media access control security MACSec protocol; and a sending module, which is used for the first network device to send a self-organizing control plane ACP message to the second network device through the MACSec channel established by the establishment module. The ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message.

[0016] In combination with the third aspect, in an implementation manner of the third aspect, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0017] In combination with the third aspect and the above-mentioned implementation manner, in another implementation manner of the third aspect, the identification information is carried in a flag bit field in the frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0018] In combination with the third aspect and the above-mentioned implementation manner, in another implementation manner of the third aspect, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0019] In a fourth aspect, a second network device for message transmission is provided, which is used in a self-organizing network, and the second network device includes: an establishment module, used by the second network device to establish a MACSec channel with the first network device according to the media access control security MACSec protocol; a receiving module, used by the second network device to receive the MACSec frame sent by the first network device through the MACSec channel established by the establishment module; and a determination module, used by the second network device to determine the ACP message based on the identification information for identifying the self-organizing control plane ACP message carried in the frame header of the MACSec frame received by the receiving module.

[0020] In combination with the fourth aspect, in an implementation manner of the fourth aspect, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0021] In combination with the fourth aspect and the above-mentioned implementation manner, in another implementation manner of the fourth aspect, the identification information is carried in a flag bit field in the frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0022] In combination with the fourth aspect and the above-mentioned implementation manner, in another implementation manner of the fourth aspect, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0023] In a fifth aspect, a system for message transmission is provided, which is applied in a self-organizing network, and the system includes: the above-mentioned first network device and second network device, the first network device establishes a MACSec channel with the second network device according to the media access control security MACSec protocol; through the MACSec channel, the first network device sends a self-organizing control plane ACP message to the second network device, the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message; the second network device receives the MACSec frame; the second network device determines the ACP message based on the identification information for identifying the self-organizing control plane ACP message carried in the frame header of the MACSec frame.

[0024] Based on the above technical scheme, the message transmission method, device and system of the embodiment of the present invention, according to the MACSec protocol, establishes a MACSec channel between the first network device and the second network device in the self-organizing network, through which the MACSec frame can be transmitted between the first network device and the second network device, and the frame header of the MACSec frame carries identification information, and the ACP message can be represented according to the identification information, so that there is no need to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time, but according to the MACSec protocol, a MACSec security mechanism is provided for ACP, and there is no need to use an L3 tunnel, thereby improving efficiency. In addition, the ACP message in the MACSec frame can be distinguished by the identification information, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments of the present invention are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 It is a schematic flow chart of a method for message transmission according to an embodiment of the present invention.

[0027] Figure 2 It is a schematic diagram of a MACSec frame structure in a message transmission method according to an embodiment of the present invention.

[0028] Figure 3 It is a schematic diagram of another MACSec frame structure in the message transmission method according to an embodiment of the present invention.

[0029] Figure 4 It is a schematic diagram of another MACSec frame structure in the message transmission method according to an embodiment of the present invention.

[0030] Figure 5 is a schematic flow chart of a message transmission method according to another embodiment of the present invention.

[0031] Figure 6 is a schematic block diagram of a first network device for message transmission according to an embodiment of the present invention.

[0032] Figure 7 is a schematic block diagram of a second network device for message transmission according to an embodiment of the present invention.

[0033] Figure 8 is a schematic block diagram of a system for message transmission according to an embodiment of the present invention.

[0034] Fig. 9 is a schematic block diagram of a first network device for message transmission according to another embodiment of the present invention.

[0035] Fig.10 is a schematic block diagram of a second network device for message transmission according to another embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] Figure 1 FIG. 1 is a schematic flow chart of a method 100 for message transmission according to an embodiment of the present invention. The method 100 can be applied in a self-organizing network and executed by a first network device in the self-organizing network. The first network device can be a sending node. Figure 1 As shown, the method 100 includes:

[0038] S110, the first network device establishes a MACSec channel with the second network device according to the media access control security MACSec protocol;

[0039] S120, the first network device sends a self-organizing control plane ACP message to the second network device through the MACSec channel, the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message.

[0040] Specifically, in a self-organizing network, a node can be set as an authentication (Registrar) node. The Registrar node is configured with a whitelist of the unique device identification (UDI) of the self-organizing node. The nodes in the UDI whitelist can join the self-organizing domain, and the Registrar node itself is connected to the domain CA (self-organizing domain digital certificate certification authority) to support the allocation of domain certificates. Each node in the network initiates a neighbor discovery (AD) message to find neighbor nodes through the AD message, and the AD message includes a UDI or domain certificate. According to the AD message, each node can create a neighbor list; after receiving the AD message, the Registrar node compares the UDI whitelist and sends a domain certificate to the neighbor node belonging to the UDI whitelist. Based on the domain certificate, the neighbor node and the Registrar node authenticate each other, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and the MACSec channel between the Registrar node and the neighbor node is established according to the Media Access Control Security (MACSec) protocol. Similarly, for the neighbor nodes of the neighbor nodes of the Registrar node, the neighbor nodes of the Registrar node need to be used as proxy servers and authentication points, and the other steps are the same, so as to establish a MACSec channel between adjacent nodes in the self-organizing network, so that multiple nodes belonging to the same domain form an ACP. In the ACP, each node can transmit ACP messages encapsulated according to the MACSec protocol to each other through the MACSec channel.

[0041] Therefore, the message transmission method of the embodiment of the present invention, according to the MACSec protocol, establishes a MACSec channel between the first network device and the second network device in the self-organizing network, through the MACSec channel, the first network device sends an ACP message to the second network device, the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message, so that there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time, and the MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0042] In an embodiment of the present invention, each node in the self-organizing network supports self-organizing characteristics, and each node has its own UDI or device ID certificate (IDevID certificate). Optionally, each node is taken as an example to obtain a domain certificate through UDI, but the present invention is not limited to this. In the network, one of the nodes is set as an authentication (Registrar) node, the Registrar node supports the allocation of domain certificates, and is configured with a UDI whitelist of self-organizing nodes. The nodes in the UDI whitelist belong to the same self-organizing domain. Optionally, the Registrar node can be pre-configured, and the Registrar node can support the node that allocates domain certificates, that is, the Registrar node is connected to the digital certificate authentication management agency and can communicate. In other words, the Registrar node can allocate domain certificates to other nodes through the digital certificate authentication management structure.

[0043] In an embodiment of the present invention, after the self-organizing feature is enabled, the self-organizing node can send an AD message to the neighboring node to find its own neighboring node. Optionally, each node can initiate an AD message every certain period of time, such as 10 seconds. The AD message may include a UDI or a domain certificate. For example, for an AD message sent by a Registrar node, the Registrar node supports the allocation of domain certificates. It will first configure a domain certificate for itself. The AD message sent by the Registrar node may include a domain certificate; and for an AD message sent by a node without a domain certificate, the AD message may include a UDI.

[0044] In an embodiment of the present invention, since the AD message sent by the self-organizing node can only be sent within a one-hop distance, that is, only the neighboring node can receive the AD message, when the node receives the AD message sent by the neighboring node, a neighbor list can be established to record the neighboring nodes belonging to the node. Optionally, the neighbor list can include the UDI of the neighboring node, and the UDI is obtained through the AD message sent by the neighboring node. The neighbor list can also include address information, and the address information can be an IPv6 address, or an IPv4 address, or a Media Access Control (MAC) address. The address information can be determined by the message of the sent AD message, but the present invention is not limited to this. According to the neighbor node list determined by the node, the UDI and address information of the neighboring nodes of each node can be determined.

[0045] In the embodiment of the present invention, when the Registrar node receives the AD message sent by the neighbor node, it compares the UDI in the AD message with the UDI whitelist in the Registrar node. If the UDI of the neighbor node matches the UDI whitelist, the Registrar node generates a domain certificate according to the UDI, sends the domain certificate to the neighbor node, and the domain certificate will be used in subsequent AD broadcasts. At this time, the Registrar node with the domain certificate and the neighbor node belong to the same ACP.

[0046] In an embodiment of the present invention, the AD message sent by the neighbor node received by the Registrar node may be the AD message of the neighbor node, or the AD message of the neighbor node forwarded by the neighbor node, and compared with the UDI whitelist, for the nodes belonging to the same domain, the Registrar node sends a domain certificate, which can be forwarded to each other through the neighbor nodes. The nodes with the domain certificate belong to the same domain, and these nodes in the self-organizing network belong to the same ACP.

[0047] In an embodiment of the present invention, when each node in the self-organizing network has its own IDevID certificate, the AD message sent by the node to the neighboring node includes a domain certificate or SUDI, wherein the AD message of the Registrar node may include a domain certificate, and the AD message of the node without a domain certificate includes SUDI. The neighboring node sends its own 802.1AR certificate to the Registrar node, optionally through a Proxy. The Registrar node that receives the message uses the public key to verify the certificate, and connects to the verification server to verify whether the device can access the domain. If the verification is successful, the Registrar node generates a domain certificate based on the SUDI and sends it to the corresponding neighboring node. The neighboring node receives the domain certificate and will use the domain certificate in subsequent AD broadcasts. Similarly, the neighboring node of the neighboring node of the Registrar node can also obtain the domain certificate through this method. The Registrar node and the neighboring node with the domain certificate belong to the same ACP.

[0048] In S110, according to the media access control security MACSec protocol, the first network device and the second network device in the self-organizing network can establish a MACSec channel, wherein the first network device and the second network device can be any two nodes in the self-organizing network, and optionally, the first network device and the second network device can be two adjacent nodes. Specifically, based on the domain certificate, the neighboring node that obtains the domain certificate can mutually authenticate with the Registrar node, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and the MACSec channel between the Registrar node and the neighboring node is established according to the MACSec protocol. Similarly, for the neighboring node of the neighboring node of the Registrar node, the neighboring node of the Registrar node can be used as a proxy server (Proxy) and an authentication point, and the other steps are consistent, thereby establishing a MACSec channel between adjacent nodes in each node belonging to the same domain. In this way, for any two nodes in the ACP, that is, the first network device and the second network device can transmit messages through the MACSec channel.

[0049] Specifically, a neighboring node that obtains the domain certificate sent by the Registrar node can initiate authentication to the Registrar node. For example, it can initiate authentication based on 802.1X. The Registrar node can act as an authenticator and authentication server to achieve mutual authentication between the Registrar node and the neighboring node. For example, the EAP-TLS (Extensible Authentication Protocol) (Transport Layer Security Protocol) authentication method can be selected to comply with the 802.1af standard.

[0050] In the embodiment of the present invention, after the Registrar node and the neighbor node are successfully authenticated, a message encryption key is negotiated based on the key generated during the authentication process, and a secure MACSec channel dedicated to the ACP is established. Specifically, according to the MACSec Key Agreement (MKA), the pairwise master key (PMK) generated in the previous authentication between the Registrar node and the neighbor node is used as the Connectivity Association Key (CAK). The Registrar node, as the Authenticator, is selected as the key server in the MKA protocol by default. It can generate a secure association key (SAK) according to the CAK, random numbers, etc. according to the 802.1X protocol, and send it to the neighbor node after encryption, so that in subsequent communications, this SAK can be enabled for encryption and signing of Ethernet frames.

[0051] In an embodiment of the present invention, after the Registrar node and the neighboring node establish a MACSec channel through the above method, when the neighboring node of the neighboring node of the Registrar node joins the ACP, the neighboring node of the Registrar node can act as a proxy server (Proxy) and an authentication point, and also obtain a domain certificate through the above method, and then join the ACP, and establish a MACSec channel with the neighboring node through verification.

[0052] In S120, within the ACP in the self-organizing network, the first network device can send an ACP message to the second network device through the established MACSec channel. Specifically, any node in the self-organizing network can send an ACP message to a neighboring node through the MACSec channel. After at least one forwarding, the ACP message can be transmitted between any two nodes in the self-organizing network, the first network device and the second network device. Since other messages can also be transmitted through the MACSec channel at the MAC layer, specifically, identification information can be carried in the frame header of the MACSec frame, and the identification information can be used to distinguish whether the MACSec frame carries an ACP message. Optionally, the following methods can be used to determine the ACP message and other messages in the message encapsulated according to the MACSec protocol.

[0053] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node sends a MACSec frame encapsulated by the MACSec protocol to a neighboring node, the frame header of the MACSec frame may carry identification information, and the identification information is used to indicate that the frame structure is used to carry ACP messages. Specifically, if the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated according to the MACSec protocol is an ACP message, and other messages can be encapsulated by MAC. After the message is decapsulated, it is processed by Global routing. For example, when the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated in the 802.1ae format sent by the node to the neighboring node is a message encapsulated according to the MACSec protocol, and the message can be understood as an ACP message. Specifically, if Figure 2 As shown, the MACSec frame encapsulated in 802.1ae format, the frame header of the MACSec frame may include: Figure 2 Among the several fields shown, the 802.1AE Header field can be identification information, indicating that the frame structure is a message encapsulated according to the MACSec protocol, and the MACSec frame is used to carry the ACP message. On the contrary, if the 802.1AE Header field is not included, it can be determined that the frame structure is other ordinary messages.

[0054] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node sends a MACSec frame encapsulated by the MACSec protocol to a neighboring node, the frame header of the MACSec frame may carry identification information, and the identification information is used to indicate that the frame structure is used to carry the ACP message. For example, the identification information may be carried in the Ethernet type field in the frame header of the transmitted MACSec frame. Specifically, the transmitted message may include an Ethernet type (Ethertype) field, for example, Figure 2As shown, the Ethernet type field may be located in the 802.1AE Header field, specifically, as Figure 3 As shown, the 802.1AE Header field may include a MACSec Ethertype field, a TCI (TAG control information) field, an AN (Association Number) field, an SL (Short Length) field, a PN (Packet Number) field, and an SCI (Secure Channel Identifier) ​​field, wherein the MACSec Ethertype field may include two octets, one octet may include 8 bits, the TCI field and the AN field may include one octet in total, the SL field may include one octet, the PN field may include 4 octets, and the SCI field may include 8 octets, but the invention is not limited thereto. In the 802.1AE Header field, the MACSec Ethertype field, i.e., the Ethernet type field carrying identification information, may optionally include identification information in the MACSec Ethertype field, or the field may be directly used as identification information. Optionally, if this field is used as identification information, it can be set that when the MACSec Ethertype value field is a preset value, the message is an ACP message; when the MACSec Ether type value is not the preset value, the message is other messages. For example, for a message encapsulated in 802.1ae format, 88e5 can be used to represent the MACSec Ethertype value, and the message is a normal message; a new MACSec Ethertype value is set to a preset value, such as 88e6, and the message is an ACP message.

[0055] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node sends a MACSec frame encapsulated by the MACSec protocol to a neighboring node, the frame header of the MACSec frame may include identification information for distinguishing ACP messages. For example, the identification information may be carried in a flag bit field in the frame header of the transmitted MACSec frame. The flag bit field may be a newly added field or an existing field. Specifically, the flag bit field may be an indication bit originally present in the message, for example, in a message encapsulated in the 802.1ae format, such as Figure 3 The TCI field and AN field shown in FIG. 1 occupy one octet, that is, the two fields occupy a total of 8 bits, which can be expanded as follows: Figure 4As shown, the 8th bit v=0 represents the version bit. The version bit is originally used to indicate the version of MACSec and is currently 0. In the embodiment of the present invention, the version bit can be used to indicate the ACP message. When the bit of this bit is "1", it indicates that the message is an ACP message; when the bit of this bit is "0", it indicates that the message is other messages. Optionally, a new flag bit can also be added to the transmission message, and the flag bit includes the identification information of the ACP message. For example, when the flag bit is "0", it indicates that the message is an ACP message; when the flag bit is "1", it indicates that the message is other messages.

[0056] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node sends a MACSec frame encapsulated by the MACSec protocol to a neighboring node, the frame header of the MACSec frame may include identification information of the ACP message, which is used to indicate that the message is an ACP message. For example, the identification information may be carried in the MAC address field in the transmission message, and whether the transmission message is an ACP message is determined according to the MAC address field. For example, the highest 8 bits of the existing MAC address, wherein the second bit b2 is used to distinguish whether the MAC address is a locally managed MAC address or a global MAC address. Since most of the existing MAC addresses are global, the b2 bit can be used as identification information to indicate whether the message is an ACP message. At this time, the locally managed MAC address (virtual MAC) and the global MAC address are used on the device interface at the same time. When the locally managed MAC address is used to transmit the message, that is, when the value of b2 is 1, the transmission message is an ACP message; when the global MAC address is used to transmit the message, that is, when the value of b2 is 0, the transmission message is other messages, but the present invention is not limited to this. Optionally, the identification information of the ACP message may be carried in other positions in the MAC address field, or one or more bits may be newly added to the MAC address field to carry the identification information.

[0057] In the embodiment of the present invention, each ACP node can generate and send an ACP message encapsulated in the MACSec protocol to a neighboring node through the above method.

[0058] Therefore, the message transmission method of the embodiment of the present invention, according to the MACSec protocol, establishes a MACSec channel between the first network device and the second network device in the self-organizing network, through the MACSec channel, the first network device sends an ACP message to the second network device, the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message, so that there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time, and the MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0059] Combined with the above Figures 1 to 4 The method for transmitting a message according to an embodiment of the present invention is described in detail from the perspective of the sending end, that is, the first network device. Figure 5 , describes the message transmission method according to an embodiment of the present invention from the perspective of the receiving end, namely the second network device.

[0060] Figure 5 FIG. 2 is a schematic flow chart of a method 200 for message transmission according to another embodiment of the present invention. The method 200 may be applied in a self-organizing network and executed by a first network device in the self-organizing network. The first network device may be a receiving node. Figure 5 As shown, the method 200 includes:

[0061] S210, the second network device establishes a MACSec channel with the first network device according to the media access control security MACSec protocol;

[0062] S220, the second network device receives the MACSec frame sent by the first network device through the MACSec channel;

[0063] S230: The second network device determines the ACP message according to the identification information for identifying the self-organizing control plane ACP message carried in the frame header of the MACSec frame.

[0064] Specifically, in a self-organizing network, a node can be set as an authentication (Registrar) node. The Registrar node is configured with a UDI whitelist of self-organizing nodes. Nodes in the UDI whitelist can join the self-organizing domain, and the Registrar node itself is connected to the domain CA (self-organizing domain digital certificate certification authority) and supports the allocation of domain certificates. Each node in the network initiates a neighbor discovery (AD) message and searches for neighbor nodes through the AD message. The AD message includes a UDI or domain certificate. According to the AD message, each node can create a neighbor list; after receiving the AD message, the Registrar node compares the UDI whitelist and sends a domain certificate to the neighbor node that belongs to the UDI whitelist. Based on the domain certificate, the neighbor node and the Registrar node authenticate each other, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and a MACSec channel is established between the Registrar node and the neighbor node according to the MACSec protocol. Similarly, for the neighbor nodes of the neighbor nodes of the Registrar node, the neighbor nodes of the Registrar node need to be used as proxy servers and authentication points, and the other steps are the same, so as to establish a MACSec channel between adjacent nodes in the self-organizing network, so that multiple nodes belonging to the same domain form an ACP. In the ACP, each node can transmit ACP messages encapsulated according to the MACSec protocol to each other through the MACSec channel.

[0065] Therefore, the message transmission method of the embodiment of the present invention, according to the MACSec protocol, establishes a MACSec channel between the second network device and the first network device in the self-organizing network, through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the frame header of the MACSec frame, so that there is no need to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time, and the MACSec security mechanism provided for transmitting the ACP message does not need to use the L3 tunnel, thereby improving the efficiency. In addition, the ACP message can be distinguished from other messages by the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network.

[0066] In an embodiment of the present invention, each node in the self-organizing network supports self-organizing characteristics, and each node has its own UDI or device ID certificate (IDevID certificate). Optionally, each node is taken as an example to obtain a domain certificate through UDI, but the present invention is not limited to this. In the network, one of the nodes is set as an authentication (Registrar) node, the Registrar node supports the allocation of domain certificates, and is configured with a UDI whitelist of self-organizing nodes. The nodes in the UDI whitelist belong to the same self-organizing domain. Optionally, the Registrar node can be pre-configured, and the Registrar node can support the node that allocates domain certificates, that is, the Registrar node is connected to the digital certificate authentication management agency and can communicate. In other words, the Registrar node can allocate domain certificates to other nodes through the digital certificate authentication management structure.

[0067] In an embodiment of the present invention, after the self-organizing feature is enabled, the self-organizing node can send an AD message to the neighboring node to find its own neighboring node. Optionally, each node can initiate an AD message every certain period of time, such as 10 seconds. The AD message may include a UDI or a domain certificate. For example, for an AD message sent by a Registrar node, the Registrar node supports the allocation of domain certificates. It will first configure a domain certificate for itself. The AD message sent by the Registrar node may include a domain certificate; and for an AD message sent by a node without a domain certificate, the AD message may include a UDI.

[0068] In an embodiment of the present invention, since the AD message sent by the self-organizing node can only be sent within a one-hop distance, that is, only the neighboring node can receive the AD message, when the node receives the AD message sent by the neighboring node, a neighbor list can be established to record the neighboring nodes belonging to the node. Optionally, the neighbor list can include the UDI of the neighboring node, and the UDI is obtained through the AD message sent by the neighboring node. The neighbor list can also include address information, and the address information can be an IPv6 address, or an IPv4 address, or a MAC address. The address information can be determined by the message of the sent AD message, but the present invention is not limited to this. According to the neighbor node list determined by the node, the UDI and address information of the neighboring nodes of each node can be determined.

[0069] In the embodiment of the present invention, when the Registrar node receives the AD message sent by the neighbor node, it compares the UDI in the AD message with the UDI whitelist in the Registrar node. If the UDI of the neighbor node matches the UDI whitelist, the Registrar node generates a domain certificate according to the UDI, sends the domain certificate to the neighbor node, and the domain certificate will be used in subsequent AD broadcasts. At this time, the Registrar node with the domain certificate and the neighbor node belong to the same ACP.

[0070] In an embodiment of the present invention, the AD message sent by the neighbor node received by the Registrar node may be the AD message of the neighbor node, or the AD message of the neighbor node forwarded by the neighbor node, and compared with the UDI whitelist, for the nodes belonging to the same domain, the Registrar node sends a domain certificate, which can be forwarded to each other through the neighbor nodes. The nodes with the domain certificate belong to the same domain, and these nodes in the self-organizing network belong to the same ACP.

[0071] In an embodiment of the present invention, when each node in the self-organizing network has its own IDevID certificate, the AD message sent by the node to the neighboring node includes a domain certificate or SUDI, wherein the AD message of the Registrar node may include a domain certificate, and the AD message of the node without a domain certificate includes SUDI. The neighboring node sends its own 802.1AR certificate to the Registrar node, optionally through a Proxy. The Registrar node that receives the message uses the public key to verify the certificate, and connects to the verification server to verify whether the device can access the domain. If the verification is successful, the Registrar node generates a domain certificate based on the SUDI and sends it to the corresponding neighboring node. The neighboring node receives the domain certificate and will use the domain certificate in subsequent AD broadcasts. Similarly, the neighboring node of the neighboring node of the Registrar node can also obtain the domain certificate through this method. The Registrar node and the neighboring node with the domain certificate belong to the same ACP.

[0072] In S210, according to the media access control security MACSec protocol, the first network device and the second network device in the self-organizing network can establish a MACSec channel, wherein the first network device and the second network device can be any two nodes in the self-organizing network, and optionally, the first network device and the second network device can be two adjacent nodes. Specifically, based on the domain certificate, the neighboring node that obtains the domain certificate can mutually authenticate with the Registrar node, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and the MACSec channel between the Registrar node and the neighboring node is established according to the MACSec protocol. Similarly, for the neighboring node of the neighboring node of the Registrar node, the neighboring node of the Registrar node can be used as a proxy server (Proxy) and an authentication point, and the other steps are consistent, thereby establishing a MACSec channel between adjacent nodes in each node belonging to the same domain. In this way, for any two nodes in the ACP, that is, the first network device and the second network device can transmit messages through the MACSec channel.

[0073] Specifically, a neighboring node that obtains the domain certificate sent by the Registrar node can initiate authentication to the Registrar node. For example, it can initiate authentication based on 802.1X. The Registrar node can act as an authenticator and authentication server to achieve mutual authentication between the Registrar node and the neighboring node. For example, the EAP-TLS authentication method can be selected to comply with the 802.1af standard.

[0074] In the embodiment of the present invention, after the Registrar node and the neighbor node are successfully authenticated, a message encryption key is negotiated based on the key generated during the authentication process, and a secure MACSec channel dedicated to ACP is established. Specifically, according to the MKA protocol, the PMK generated in the previous authentication between the Registrar node and the neighbor node is used as the CAK. The Registrar node, as the Authenticator, is selected as the key server in the MKA protocol by default. It can generate a SAK based on the CAK, random numbers, etc. according to the 802.1X protocol, and send it to the neighbor node after encryption, so that in subsequent communications, this SAK can be enabled for encryption and signing of Ethernet frames.

[0075] In an embodiment of the present invention, after the Registrar node and the neighboring node establish a MACSec channel through the above method, when the neighboring node of the neighboring node of the Registrar node joins the ACP, the neighboring node of the Registrar node can act as a proxy server (Proxy) and an authentication point, and also obtain a domain certificate through the above method, and then join the ACP, and establish a MACSec channel with the neighboring node through verification.

[0076] In S220, within the ACP in the self-organizing network, the second network device can receive the MACSec frame sent by the first network device through the MACSec channel. Specifically, any node in the self-organizing network can send an ACP message to a neighboring node through the MACSec channel, and after at least one forwarding, any two nodes in the self-organizing network, the first network device and the second network device can transmit MACSec frames.

[0077] In the embodiment of the present invention, since the frame header of the MACSec frame received by the second network device may include identification information, the identification information is used to distinguish whether the MACSec frame is an ACP message. Therefore, in S230, the second network device can determine that the MACSec frame is an ACP message based on the identification information in the frame header of the MACSec frame. Since other messages can also be transmitted through the MACSec channel at the MAC layer, specifically, it is possible to distinguish whether the MACSec frame carries an ACP message based on the identification information carried in the frame header of the MACSec frame. Optionally, the following methods can be used to determine whether the ACP message and other messages in the received message encapsulated according to the MACSec protocol.

[0078] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node receives a MACSec frame encapsulated by the MACSec protocol sent by a neighboring node, the frame header of the MACSec frame may carry identification information, and the identification information is used to indicate that the frame structure is used to carry ACP messages. Specifically, if the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated according to the MACSec protocol is an ACP message, and other messages can be encapsulated through MAC. After the message is decapsulated, it is processed by Global routing. For example, when the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated in the 802.1ae format sent by the neighboring node received by the node is a message encapsulated according to the MACSec protocol, and the message can be understood as an ACP message. Specifically, if Figure 2 As shown, the MACSec frame encapsulated in 802.1ae format, the frame header of the MACSec frame may include: Figure 2Among the several fields shown, the 802.1AE Header field can be identification information, indicating that the frame structure is a message encapsulated according to the MACSec protocol, and the MACSec frame is used to carry the ACP message. On the contrary, if the 802.1AE Header field is not included, it can be determined that the frame structure is other ordinary messages.

[0079] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node receives a MACSec frame encapsulated by the MACSec protocol sent by a neighboring node, the MACSec frame includes identification information of an ACP message, which is used to indicate that the message is an ACP message. For example, the identification information can be carried in the Ethernet type field in the frame header of the transmitted MACSec frame. Specifically, the transmitted message may include an Ethernet type (Ethertype) field, for example, Figure 2 As shown, the Ethernet type field may be located in the 802.1AE Header field, specifically, as Figure 3 As shown, the 802.1AE Header field may include a MACSec Ethertype field, a TCI field, an AN field, a SL field, a PN field, and an SCI field. In the 802.1AE Header field, the MACSec Ethertype field, i.e., the Ethernet type field carrying identification information, may optionally include identification information in the MACSec Ethertype field, or the field may be directly used as identification information. Optionally, if the field is used as identification information, it may be set such that when the MACSec Ethertype value field is a preset value, the message is an ACP message; when the MACSec Ether type value is not the preset value, the message is another message. For example, for a message encapsulated in the 802.1ae format, 88e5 may be used to represent the MACSec Ethertype value, and the message is a normal message; if a new MACSec Ethertype value is set to a preset value, such as 88e6, the message is an ACP message.

[0080] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node receives a MACSec frame encapsulated by the MACSec protocol sent by a neighboring node, the frame header of the MACSec frame includes identification information of the ACP message, which is used to indicate that the message is an ACP message. For example, the identification information can be carried in a flag bit field in the frame header of the transmitted MACSec frame. The flag bit field can be a newly added field or an existing field. Specifically, the identification bit field can be an indication bit originally present in the message, for example, in a message encapsulated in the 802.1ae format, such as Figure 3 The TCI field and AN field shown can be expanded as follows Figure 4 As shown, v=0 represents the version bit, which is originally used to indicate the version of MACSec and is currently 0. In the embodiment of the present invention, the version bit can be used to indicate the ACP message. When the bit of the bit is "1", it indicates that the message is an ACP message; when the bit of the bit is "0", it indicates that the message is other messages. Optionally, a new flag bit can also be added to the transmission message, and the flag bit includes the identification information of the ACP message. For example, when the flag bit is "0", it indicates that the message is an ACP message; when the flag bit is "1", it indicates that the message is other messages.

[0081] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when a node receives a MACSec frame encapsulated by the MACSec protocol sent by a neighboring node, the frame header of the MACSec frame includes identification information of the ACP message, which is used to indicate that the message is an ACP message. For example, the identification information can be carried in the MAC address field in the transmission message, and whether the transmission message is an ACP message is determined according to the MAC address field. For example, the highest 8 bits of the existing MAC address, wherein the second bit b2 is used to distinguish whether the MAC address is a locally managed MAC address or a global MAC address. Since most of the existing MAC addresses are global, the b2 bit can be used as identification information to indicate whether the message is an ACP message. At this time, the locally managed MAC address (virtual MAC) and the global MAC address are used on the device interface at the same time. When the locally managed MAC address is used to transmit the message, that is, when the value of b2 is 1, the transmission message is an ACP message; when the global MAC address is used to transmit the message, that is, when the value of b2 is 0, the transmission message is other messages, but the present invention is not limited to this. Optionally, the identification information of the ACP message may be carried in other positions in the MAC address field, or one or more bits may be newly added to the MAC address field to carry the identification information.

[0082] In an embodiment of the present invention, a node in a self-organizing network receives a MACSec protocol-encapsulated MACSec frame sent by a neighboring node, and determines an ACP message based on identification information included in the frame header of the MACSec frame. Specifically, the above method can be used to determine which are ACP messages.

[0083] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0084] Therefore, the message transmission method of the embodiment of the present invention, according to the MACSec protocol, establishes a MACSec channel between the second network device and the first network device in the self-organizing network, through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the frame header of the MACSec frame, so that there is no need to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time, and the MACSec security mechanism provided for transmitting the ACP message does not need to use the L3 tunnel, thereby improving the efficiency. In addition, the ACP message can be distinguished from other messages by the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network.

[0085] Combined with the above Figures 1 to 5 , describes in detail the message transmission method according to the embodiment of the present invention, and will be combined with Figure 6 and Figure 7 , describes a device for message transmission according to an embodiment of the present invention.

[0086] Figure 6 FIG. 2 shows a schematic flow chart of a first network device 300 for message transmission according to an embodiment of the present invention. The first network device 300 may be a sending node in a self-organizing network. Figure 6 As shown, the first network device 300 includes:

[0087] An establishing module 310 is used for the first network device to establish a MACSec channel with the second network device according to the media access control security MACSec protocol;

[0088] The sending module 320 is used for the first network device to send a self-organizing control plane ACP message to the second network device through the MACSec channel established by the establishment module. The ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message.

[0089] Specifically, a node in the self-organizing network can be set as an authentication (Registrar) node. The Registrar node is configured with a UDI whitelist of self-organizing nodes. Nodes in the UDI whitelist can join the self-organizing domain, and the Registrar node itself is connected to the domain CA (self-organizing domain digital certificate certification authority) to support the allocation of domain certificates. Each node in the network initiates a neighbor discovery (AD) message and searches for neighbor nodes through the AD message. The AD message includes a UDI or domain certificate. According to the AD message, each node can create a neighbor list; after receiving the AD message, the Registrar node compares the UDI whitelist and sends a domain certificate to the neighbor node that belongs to the UDI whitelist. Based on the domain certificate, the neighbor node and the Registrar node authenticate each other, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and a MACSec channel is established between the Registrar node and the neighbor node according to the MACSec protocol. Similarly, for the neighbor nodes of the neighbor nodes of the Registrar node, the neighbor nodes of the Registrar node need to be used as proxy servers and authentication points, and the other steps are the same, so as to establish a MACSec channel between adjacent nodes in the self-organizing network, so that multiple nodes belonging to the same domain form an ACP. In the ACP, each node can transmit ACP messages encapsulated according to the MACSec protocol to each other through the MACSec channel.

[0090] Therefore, the first network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the establishment module of the first network device in the self-organizing network and the second network device according to the MACSec protocol. Through the MACSec channel, the sending module of the first network device sends an ACP message to the second network device. The ACP message is carried in a MACSec frame. The frame header of the MACSec frame carries identification information for identifying the ACP message, so there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0091] In an embodiment of the present invention, each node in the self-organizing network supports self-organizing characteristics, and each node has its own UDI or device ID certificate (IDevID certificate). Optionally, each node is taken as an example to obtain a domain certificate through UDI, but the present invention is not limited to this. In the network, one of the nodes is set as an authentication (Registrar) node, the Registrar node supports the allocation of domain certificates, and is configured with a UDI whitelist of self-organizing nodes. The nodes in the UDI whitelist belong to the same self-organizing domain. Optionally, the Registrar node can be pre-configured, and the Registrar node can support the node that allocates domain certificates, that is, the Registrar node is connected to the digital certificate authentication management agency and can communicate. In other words, the Registrar node can allocate domain certificates to other nodes through the digital certificate authentication management structure.

[0092] In an embodiment of the present invention, after the self-organizing feature is enabled, the self-organizing node can send an AD message to the neighboring node to find its own neighboring node. Optionally, each node can initiate an AD message every certain period of time, such as 10 seconds. The AD message may include a UDI or a domain certificate. For example, for an AD message sent by a Registrar node, the Registrar node supports the allocation of domain certificates. It will first configure a domain certificate for itself. The AD message sent by the Registrar node may include a domain certificate; and for an AD message sent by a node without a domain certificate, the AD message may include a UDI.

[0093] In an embodiment of the present invention, since the AD message sent by the self-organizing node can only be sent within a one-hop distance, that is, only the neighboring node can receive the AD message, when the node receives the AD message sent by the neighboring node, a neighbor list can be established to record the neighboring nodes belonging to the node. Optionally, the neighbor list can include the UDI of the neighboring node, and the UDI is obtained through the AD message sent by the neighboring node. The neighbor list can also include address information, and the address information can be an IPv6 address, or an IPv4 address, or a MAC address. The address information can be determined by the message of the sent AD message, but the present invention is not limited to this. According to the neighbor node list determined by the node, the UDI and address information of the neighboring nodes of each node can be determined.

[0094] In the embodiment of the present invention, when the Registrar node receives the AD message sent by the neighbor node, it compares the UDI in the AD message with the UDI whitelist in the Registrar node. If the UDI of the neighbor node matches the UDI whitelist, the Registrar node generates a domain certificate according to the UDI, sends the domain certificate to the neighbor node, and the domain certificate will be used in subsequent AD broadcasts. At this time, the Registrar node with the domain certificate and the neighbor node belong to the same ACP.

[0095] In an embodiment of the present invention, the AD message sent by the neighbor node received by the Registrar node may be the AD message of the neighbor node, or the AD message of the neighbor node forwarded by the neighbor node, and compared with the UDI whitelist, for the nodes belonging to the same domain, the Registrar node sends a domain certificate, which can be forwarded to each other through the neighbor nodes. The nodes with the domain certificate belong to the same domain, and these nodes in the self-organizing network belong to the same ACP.

[0096] In an embodiment of the present invention, when each node in the self-organizing network has its own IDevID certificate, the AD message sent by the node to the neighboring node includes a domain certificate or SUDI, wherein the AD message of the Registrar node may include a domain certificate, and the AD message of the node without a domain certificate includes SUDI. The neighboring node sends its own 802.1AR certificate to the Registrar node, optionally through a Proxy. The Registrar node that receives the message uses the public key to verify the certificate, and connects to the verification server to verify whether the device can access the domain. If the verification is successful, the Registrar node generates a domain certificate based on the SUDI and sends it to the corresponding neighboring node. The neighboring node receives the domain certificate and will use the domain certificate in subsequent AD broadcasts. Similarly, the neighboring node of the neighboring node of the Registrar node can also obtain the domain certificate through this method. The Registrar node and the neighboring node with the domain certificate belong to the same ACP.

[0097] In an embodiment of the present invention, according to the MACSec protocol, the establishment module 310 of the first network device in the self-organizing network establishes a MACSec channel with the second network device, wherein the first network device and the second network device can be any two nodes in the self-organizing network, and optionally, the first network device and the second network device can be two adjacent nodes. Specifically, based on the domain certificate, the neighboring node that obtains the domain certificate can mutually authenticate with the Registrar node, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and the MACSec channel between the Registrar node and the neighboring node is established according to the MACSec protocol. Similarly, for the neighboring node of the neighboring node of the Registrar node, the neighboring node of the Registrar node can be used as a proxy server (Proxy) and an authentication point, and the other steps are consistent, thereby establishing a MACSec channel between adjacent nodes in each node belonging to the same domain. In this way, for any two nodes in the ACP, that is, the first network device and the second network device can transmit messages through the MACSec channel.

[0098] Specifically, a neighboring node that obtains the domain certificate sent by the Registrar node can initiate authentication to the Registrar node. For example, it can initiate authentication based on 802.1X. The Registrar node can act as an authenticator and authentication server to achieve mutual authentication between the Registrar node and the neighboring node. For example, the EAP-TLS authentication method can be selected to comply with the 802.1af standard.

[0099] In the embodiment of the present invention, after the Registrar node and the neighbor node are successfully authenticated, a message encryption key is negotiated based on the key generated during the authentication process, and a secure MACSec channel dedicated to ACP is established. Specifically, according to the MKA protocol, the PMK generated in the previous authentication between the Registrar node and the neighbor node is used as the CAK. The Registrar node, as the Authenticator, is selected as the key server in the MKA protocol by default. It can generate a SAK based on the CAK, random numbers, etc. according to the 802.1X protocol, and send it to the neighbor node after encryption, so that in subsequent communications, this SAK can be enabled for encryption and signing of Ethernet frames.

[0100] In an embodiment of the present invention, after the Registrar node and the neighboring node establish a MACSec channel through the above method, when the neighboring node of the neighboring node of the Registrar node joins the ACP, the neighboring node of the Registrar node can act as a proxy server (Proxy) and an authentication point, and also obtain a domain certificate through the above method, and then join the ACP, and establish a MACSec channel with the neighboring node through verification.

[0101] In an embodiment of the present invention, within the ACP in the self-organizing network, the sending module 320 of the first network device can send an ACP message to the second network device through the MACSec channel established by the establishment module 310. Specifically, the sending module 320 of any node in the self-organizing network can send an ACP message to a neighboring node through the MACSec channel. After at least one forwarding, the ACP message can be transmitted between any two nodes in the self-organizing network, the first network device and the second network device. Since other messages can also be transmitted through the MACSec channel at the MAC layer, specifically, identification information can be carried in the frame header of the MACSec frame, and the identification information can be used to distinguish whether the MACSec frame carries an ACP message. Optionally, the following methods can be used to determine the ACP message and other messages in the message encapsulated according to the MACSec protocol.

[0102] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, the sending module 320 of the node sends a MACSec frame encapsulated by the MACSec protocol to the neighboring node. The frame header of the MACSec frame may carry identification information, and the identification information is used to indicate that the frame structure is used to carry ACP messages. Specifically, if the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated according to the MACSec protocol is an ACP message, and other messages can be encapsulated by MAC. After the message is decapsulated, it is processed by Global routing. For example, when the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated in the 802.1ae format sent by the node to the neighboring node is a message encapsulated according to the MACSec protocol, and the message can be understood as an ACP message. Specifically, if Figure 2 As shown, the MACSec frame encapsulated in 802.1ae format, the frame header of the MACSec frame may include: Figure 2 Among the several fields shown, the 802.1AE Header field can be identification information, indicating that the frame structure is a message encapsulated according to the MACSec protocol, and the MACSec frame is used to carry the ACP message. On the contrary, if the 802.1AE Header field is not included, it can be determined that the frame structure is other ordinary messages.

[0103] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, the sending module 320 of the node sends a MACSec frame encapsulated by the MACSec protocol to the neighboring node. The frame header of the MACSec frame may carry identification information, and the identification information is used to indicate that the frame structure is used to carry the ACP message. For example, the identification information may be carried in the Ethernet type field in the transmitted message. Specifically, the transmitted message may include an Ethernet type (Ethertype) field, for example, Figure 2 As shown, the Ethernet type field may be located in the 802.1AE Header field, specifically, as Figure 3 As shown, the 802.1AE Header field may include a MACSec Ethertype field, a TCI field, an AN field, a SL field, a PN field, and an SCI field. In the 802.1AE Header field, the MACSec Ethertype field, i.e., the Ethernet type field carrying identification information, may optionally include identification information in the MACSec Ethertype field, or the field may be directly used as identification information. Optionally, if the field is used as identification information, it may be set such that when the MACSec Ethertype value field is a preset value, the message is an ACP message; when the MACSec Ether type value is not the preset value, the message is another message. For example, for a message encapsulated in the 802.1ae format, 88e5 may be used to represent the MACSecEthertype value, and the message is a normal message; if a new MACSec Ethertype value is set to a preset value, such as 88e6, the message is an ACP message.

[0104] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, the sending module 320 of the node sends a MACSec frame encapsulated by the MACSec protocol to the neighboring node. The frame header of the MACSec frame may include identification information for distinguishing ACP messages. For example, the identification information may be carried in a flag bit field in the frame header of the transmitted MACSec frame. The flag bit field may be a newly added field or an existing field. Specifically, the flag bit field may be an indication bit originally present in the message, for example, in a message encapsulated in the 802.1ae format, such as Figure 3 The TCI field and AN field shown can be expanded as follows Figure 4As shown, v=0 represents the version bit, which is originally used to indicate the version of MACSec and is currently 0. In the embodiment of the present invention, the version bit can be used to indicate the ACP message. When the bit of the bit is "1", it indicates that the message is an ACP message; when the bit of the bit is "0", it indicates that the message is other messages. Optionally, a new flag bit can also be added to the transmission message, and the flag bit includes the identification information of the ACP message. For example, when the flag bit is "0", it indicates that the message is an ACP message; when the flag bit is "1", it indicates that the message is other messages.

[0105] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, the sending module 320 of the node sends a MACSec frame encapsulated by the MACSec protocol to the neighboring node, and the frame header of the MACSec frame may include identification information of the ACP message, which is used to indicate that the message is an ACP message. For example, the identification information may be carried in the MAC address field in the transmission message, and whether the transmission message is an ACP message is determined according to the MAC address field. For example, the highest 8 bits of the existing MAC address, wherein the second bit b2 is used to distinguish whether the MAC address is a locally managed MAC address or a global MAC address. Since most of the existing MAC addresses are global, the b2 bit can be used as identification information to indicate whether the message is an ACP message. At this time, the device interface uses both the local management MAC address (virtual MAC) and the global MAC address. When the local management MAC address is used to transmit a message, that is, when the value of b2 is 1, the transmitted message is an ACP message; when the global MAC address is used to transmit a message, that is, when the value of b2 is 0, the transmitted message is other messages, but the present invention is not limited to this. Optionally, the identification information of the ACP message can also be carried in other positions in the MAC address field, and one or more bits can be newly added to the MAC address field to carry the identification information.

[0106] In the embodiment of the present invention, each ACP node can use the above method to send the ACP message encapsulated by the MACSec protocol to the neighboring node by the sending module 320.

[0107] It should be understood that the first network device 300 for message transmission according to the embodiment of the present invention may correspond to the method 100 in the embodiment of the present invention, and the above and other operations and / or functions of each module in the first network device 300 for message transmission are respectively to implement Figure 1 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0108] Therefore, the first network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the establishment module of the first network device in the self-organizing network and the second network device according to the MACSec protocol. Through the MACSec channel, the sending module of the first network device sends an ACP message to the second network device. The ACP message is carried in a MACSec frame. The frame header of the MACSec frame carries identification information for identifying the ACP message, so there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0109] Figure 7 FIG. 4 is a schematic flow chart of a second network device 400 for message transmission according to another embodiment of the present invention, wherein the second network device 400 can self-organize a receiving node in a network. Figure 7 As shown, the second network device 400 includes:

[0110] Establishing module 410, used for the second network device to establish a MACSec channel with the first network device according to the media access control security MACSec protocol;

[0111] A receiving module 420, configured for the second network device to receive a MACSec frame sent by the first network device through the MACSec channel established by the establishing module;

[0112] The determination module 430 is used for the second network device to determine the ACP message according to the identification information for identifying the self-organizing control plane ACP message carried in the frame header of the MACSec frame received by the receiving module.

[0113] Specifically, a node in the self-organizing network can be set as an authentication (Registrar) node. The Registrar node is configured with a UDI whitelist of self-organizing nodes. Nodes in the UDI whitelist can join the self-organizing domain, and the Registrar node itself is connected to the domain CA and supports the allocation of domain certificates. Each node in the network initiates a neighbor discovery (AD) message and searches for neighbor nodes through the AD message. The AD message includes a UDI or domain certificate. According to the AD message, each node can create a neighbor list; after receiving the AD message, the Registrar node compares the UDI whitelist and sends a domain certificate to the neighbor node that belongs to the UDI whitelist. Based on the domain certificate, the neighbor node and the Registrar node authenticate each other, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and a MACSec channel is established between the Registrar node and the neighbor node according to the MACSec protocol. Similarly, for the neighbor nodes of the neighbor nodes of the Registrar node, the neighbor nodes of the Registrar node need to be used as proxy servers and authentication points, and the other steps are the same, so as to establish a MACSec channel between adjacent nodes in the self-organizing network, so that multiple nodes belonging to the same domain form an ACP. In the ACP, each node can transmit ACP messages encapsulated according to the MACSec protocol to each other through the MACSec channel.

[0114] Therefore, the second network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the second network device and the first network device according to the MACSec protocol. Through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the MACSec frame, so that it is not necessary to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use L3 tunnels, thereby improving efficiency. In addition, the ACP message can be distinguished from other messages through the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network through the MACSec channel.

[0115] In an embodiment of the present invention, each node in the self-organizing network supports self-organizing characteristics, and each node has its own UDI or device ID certificate (IDevID certificate). Optionally, each node is taken as an example to obtain a domain certificate through UDI, but the present invention is not limited to this. In the network, one of the nodes is set as an authentication (Registrar) node, the Registrar node supports the allocation of domain certificates, and is configured with a UDI whitelist of self-organizing nodes. The nodes in the UDI whitelist belong to the same self-organizing domain. Optionally, the Registrar node can be pre-configured, and the Registrar node can support the node that allocates domain certificates, that is, the Registrar node is connected to the digital certificate authentication management agency and can communicate. In other words, the Registrar node can allocate domain certificates to other nodes through the digital certificate authentication management structure.

[0116] In an embodiment of the present invention, after the self-organizing feature is enabled, the self-organizing node can send an AD message to the neighboring node to find its own neighboring node. Optionally, each node can initiate an AD message every certain period of time, such as 10 seconds. The AD message may include a UDI or a domain certificate. For example, for an AD message sent by a Registrar node, the Registrar node supports the allocation of domain certificates. It will first configure a domain certificate for itself. The AD message sent by the Registrar node may include a domain certificate; and for an AD message sent by a node without a domain certificate, the AD message may include a UDI.

[0117] In an embodiment of the present invention, since the AD message sent by the self-organizing node can only be sent within a one-hop distance, that is, only the neighboring node can receive the AD message, when the node receives the AD message sent by the neighboring node, a neighbor list can be established to record the neighboring nodes belonging to the node. Optionally, the neighbor list can include the UDI of the neighboring node, and the UDI is obtained through the AD message sent by the neighboring node. The neighbor list can also include address information, and the address information can be an IPv6 address, or an IPv4 address, or a MAC address. The address information can be determined by the message of the sent AD message, but the present invention is not limited to this. According to the neighbor node list determined by the node, the UDI and address information of the neighboring nodes of each node can be determined.

[0118] In the embodiment of the present invention, when the Registrar node receives the AD message sent by the neighbor node, it compares the UDI in the AD message with the UDI whitelist in the Registrar node. If the UDI of the neighbor node matches the UDI whitelist, the Registrar node generates a domain certificate according to the UDI, sends the domain certificate to the neighbor node, and the domain certificate will be used in subsequent AD broadcasts. At this time, the Registrar node with the domain certificate and the neighbor node belong to the same ACP.

[0119] In an embodiment of the present invention, the AD message sent by the neighbor node received by the Registrar node may be the AD message of the neighbor node, or the AD message of the neighbor node forwarded by the neighbor node, and compared with the UDI whitelist, for the nodes belonging to the same domain, the Registrar node sends a domain certificate, which can be forwarded to each other through the neighbor nodes. The nodes with the domain certificate belong to the same domain, and these nodes in the self-organizing network belong to the same ACP.

[0120] In an embodiment of the present invention, when each node in the self-organizing network has its own IDevID certificate, the AD message sent by the node to the neighboring node includes a domain certificate or SUDI, wherein the AD message of the Registrar node may include a domain certificate, and the AD message of the node without a domain certificate includes SUDI. The neighboring node sends its own 802.1AR certificate to the Registrar node, optionally through a Proxy. The Registrar node that receives the message uses the public key to verify the certificate, and connects to the verification server to verify whether the device can access the domain. If the verification is successful, the Registrar node generates a domain certificate based on the SUDI and sends it to the corresponding neighboring node. The neighboring node receives the domain certificate and will use the domain certificate in subsequent AD broadcasts. Similarly, the neighboring node of the neighboring node of the Registrar node can also obtain the domain certificate through this method. The Registrar node and the neighboring node with the domain certificate belong to the same ACP.

[0121] In an embodiment of the present invention, according to the MACSec protocol, the establishment module 410 of the first network device in the self-organizing network establishes a MACSec channel with the first network device, wherein the first network device and the second network device can be any two nodes in the self-organizing network, and optionally, the first network device and the second network device can be two adjacent nodes. Specifically, based on the domain certificate, the neighboring node that obtains the domain certificate can mutually authenticate with the Registrar node, and after the authentication is successful, the message encryption key is negotiated based on the key generated during the authentication process, and the MACSec channel between the Registrar node and the neighboring node is established according to the MACSec protocol. Similarly, for the neighboring node of the neighboring node of the Registrar node, the neighboring node of the Registrar node can be used as a proxy server (Proxy) and an authentication point, and the other steps are consistent, thereby establishing a MACSec channel between adjacent nodes in each node belonging to the same domain. In this way, for any two nodes in the ACP, that is, the first network device and the second network device can transmit messages through the MACSec channel.

[0122] Specifically, a neighboring node that obtains the domain certificate sent by the Registrar node can initiate authentication to the Registrar node. For example, it can initiate authentication based on 802.1X. The Registrar node can act as an authenticator and authentication server to achieve mutual authentication between the Registrar node and the neighboring node. For example, the EAP-TLS authentication method can be selected to comply with the 802.1af standard.

[0123] In the embodiment of the present invention, after the Registrar node and the neighbor node are successfully authenticated, a message encryption key is negotiated based on the key generated during the authentication process, and a secure MACSec channel dedicated to ACP is established. Specifically, according to the MKA protocol, the PMK generated in the previous authentication between the Registrar node and the neighbor node is used as the CAK. The Registrar node, as the Authenticator, is selected as the key server in the MKA protocol by default. It can generate a SAK based on the CAK, random numbers, etc. according to the 802.1X protocol, and send it to the neighbor node after encryption, so that in subsequent communications, this SAK can be enabled for encryption and signing of Ethernet frames.

[0124] In an embodiment of the present invention, after the Registrar node and the neighboring node establish a MACSec channel through the above method, when the neighboring node of the neighboring node of the Registrar node joins the ACP, the neighboring node of the Registrar node can act as a proxy server (Proxy) and an authentication point, and also obtain a domain certificate through the above method, and then join the ACP, and establish a MACSec channel with the neighboring node through verification.

[0125] In the embodiment of the present invention, within the ACP in the self-organizing network, the receiving module 420 of the second network device can receive the MACSec frame sent by the first network device through the MACSec channel. Specifically, any node in the self-organizing network can send an ACP message to a neighboring node through the MACSec channel, and after at least one forwarding, any two nodes in the self-organizing network, the first network device and the second network device can transmit MACSec frames.

[0126] In the embodiment of the present invention, since the frame header of the MACSec frame received by the receiving module 420 of the second network device may include identification information, the identification information is used to distinguish whether the MACSec frame is an ACP message. Therefore, the determination module 430 of the second network device can determine that the MACSec frame is an ACP message based on the identification information in the frame header of the MACSec frame. Since other messages can also be transmitted through the MACSec channel at the MAC layer, specifically, it is possible to distinguish whether the MACSec frame carries an ACP message based on the identification information carried in the frame header of the MACSec frame. Optionally, the following methods can be used to determine whether the ACP message and other messages in the received message encapsulated according to the MACSec protocol.

[0127] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when the receiving module 420 of the node receives a MACSec frame encapsulated by the MACSec protocol sent by the neighboring node, the determination module 430 can determine the ACP message based on the identification information carried in the frame header of the MACSec frame. Specifically, if the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated according to the MACSec protocol is an ACP message, and other messages can be encapsulated through MAC. After the message is decapsulated, it is processed by Global routing. For example, when the entire self-organizing network does not enable MACSec on the data plane, the message encapsulated in the 802.1ae format sent by the neighboring node received by the node is a message encapsulated according to the MACSec protocol, and the message can be understood as an ACP message. Specifically, if Figure 2 As shown, the MACSec frame encapsulated in 802.1ae format, the frame header of the MACSec frame may include: Figure 2Among the several fields shown, the 802.1AE Header field can be identification information, indicating that the frame structure is a message encapsulated according to the MACSec protocol, and the MACSec frame is used to carry the ACP message. On the contrary, if the 802.1AE Header field is not included, it can be determined that the frame structure is other ordinary messages.

[0128] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when the receiving module 420 of the node receives a MACSec frame encapsulated by the MACSec protocol sent by the neighboring node, the determining module 430 can determine that the message is an ACP message according to the identification information of the ACP message included in the MACSec frame. For example, the identification information can be carried in the Ethernet type field in the frame header of the transmitted MACSec frame. Specifically, the transmitted message may include an Ethernet type (Ethertype) field, for example, Figure 2 As shown, the Ethernet type field may be located in the 802.1AE Header field, specifically, as Figure 3 As shown, the 802.1AE Header field may include a MACSec Ethertype field, a TCI field, an AN field, a SL field, a PN field, and an SCI field. In the 802.1AE Header field, the MACSec Ethertype field, i.e., the Ethernet type field carrying identification information, may optionally include identification information in the MACSec Ethertype field, or the field may be directly used as identification information. Optionally, if the field is used as identification information, it may be set such that when the MACSec Ethertype value field is a preset value, the message is an ACP message; when the MACSec Ethertype value is not the preset value, the message is another message. For example, for a message encapsulated in the 802.1ae format, 88e5 may be used to represent the MACSec Ethertype value, and the message is a normal message; if a new MACSec Ethertype value is set to a preset value, such as 88e6, the message is an ACP message.

[0129] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when the receiving module 420 of the node receives a MACSec frame encapsulated by the MACSec protocol sent by the neighboring node, the determining module 430 can determine that the message is an ACP message based on the identification information of the ACP message included in the frame header of the MACSec frame. For example, the identification information can be carried in the flag bit field in the frame header of the transmitted MACSec frame. The flag bit field can be a newly added field or an existing field. Specifically, the identification bit field can be an indication bit originally in the message, for example, in a message encapsulated in the 802.1ae format, such as Figure 3 The TCI field and AN field shown can be expanded as follows Figure 4 As shown, v=0 represents the version bit, which is originally used to indicate the version of MACSec and is currently 0. In the embodiment of the present invention, the version bit can be used to indicate the ACP message. When the bit of the bit is "1", it indicates that the message is an ACP message; when the bit of the bit is "0", it indicates that the message is other messages. Optionally, a new flag bit can also be added to the transmission message, and the flag bit includes the identification information of the ACP message. For example, when the flag bit is "0", it indicates that the message is an ACP message; when the flag bit is "1", it indicates that the message is other messages.

[0130] Optionally, as an embodiment, taking the transmission of messages between neighboring nodes as an example, when the receiving module 420 of the node receives a MACSec frame encapsulated by the MACSec protocol sent by the neighboring node, the determination module 430 can determine that the message is an ACP message based on the identification information of the ACP message included in the frame header of the MACSec frame. For example, the identification information can be carried in the MAC address field in the transmission message, and whether the transmission message is an ACP message is determined based on the MAC address field. For example, the highest 8 bits of the existing MAC address, where the second bit b2 is used to distinguish whether the MAC address is a locally managed MAC address or a global MAC address. Since most of the existing MAC addresses are global, the b2 bit can be used as identification information to indicate whether the message is an ACP message. At this time, the device interface uses both the local management MAC address (virtual MAC) and the global MAC address. When the local management MAC address is used to transmit a message, that is, when the value of b2 is 1, the transmitted message is an ACP message; when the global MAC address is used to transmit a message, that is, when the value of b2 is 0, the transmitted message is other messages, but the present invention is not limited to this. Optionally, the identification information of the ACP message can also be carried in other positions in the MAC address field, and one or more bits can be newly added to the MAC address field to carry the identification information.

[0131] In an embodiment of the present invention, the receiving module 420 of the node in the self-organizing network receives a MACSec frame encapsulated by the MACSec protocol sent by a neighboring node, and the determination module 430 determines the ACP message based on the identification information included in the frame header of the MACSec frame. Specifically, the above method can be used to determine which ones are ACP messages.

[0132] It should be understood that the second network device 400 for message transmission according to the embodiment of the present invention may correspond to the method 200 in the embodiment of the present invention, and the above and other operations and / or functions of each module in the second network device 400 for message transmission are respectively to achieve Figure 5 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0133] Therefore, the second network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the second network device and the first network device according to the MACSec protocol. Through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the MACSec frame, so that it is not necessary to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use L3 tunnels, thereby improving efficiency. In addition, the ACP message can be distinguished from other messages through the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network through the MACSec channel.

[0134] like Figure 8 As shown, an embodiment of the present invention further provides a system 500 for message transmission, which may include a first network device 510 and a second network device 520. The first network device 510 establishes a MACSec channel with the second network device 520 according to the MACSec protocol; through the MACSec channel, the first network device 510 sends an ACP message to the second network device 520, the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message; the second network device 520 receives the MACSec frame; the second network device 520 determines the ACP message according to the identification information for identifying the ACP message carried in the frame header of the MACSec frame.

[0135] The first network device 510 may be Figure 6 The first network device 300 shown in the figure, the second network device 520 can be as follows Figure 7 A second network device 400 is shown.

[0136] The first network device 510 may also include Figure 6 The establishment module 310 and the sending module 320 shown in FIG. 5 may further include the following: Figure 7 An establishing module 410, a receiving module 420 and a determining module 430 are shown.

[0137] Therefore, the system for message transmission in the embodiment of the present invention includes a first network device and a second network device in a self-organizing network. According to the MACSec protocol, a MACSec channel is established between the first network device and the second network device. Through the MACSec channel, MACSec frames can be transmitted between the first network device and the second network device. The frame header of the MACSec frame carries identification information, and the ACP message can be represented according to the identification information, so that there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time. Instead, according to the MACSec protocol, a MACSec security mechanism is provided for ACP, and there is no need to use an L3 tunnel, thereby improving efficiency. In addition, the ACP message in the MACSec frame can be distinguished by the identification information, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network.

[0138] like Fig. 9 As shown, the embodiment of the present invention further provides a first network device 600 for message transmission, and the first network device 600 includes a processor 610, a memory 620, a transmitter 630 and a bus system 640. The processor 610, the memory 620 and the transmitter 630 are connected through the bus system 640, the memory 620 is used to store instructions, and the processor 610 is used to execute the instructions stored in the memory 620 to control the transmitter 630 to send signals. The processor 610 is used for the first network device to establish a MACSec channel with the second network device according to the media access control security MACSec protocol; the transmitter 630 is used for the first network device to send a self-organizing control plane ACP message to the second network device through the MACSec channel, and the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message.

[0139] Therefore, the first network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the establishment module of the first network device in the self-organizing network and the second network device according to the MACSec protocol. Through the MACSec channel, the sending module of the first network device sends an ACP message to the second network device. The ACP message is carried in a MACSec frame. The frame header of the MACSec frame carries identification information for identifying the ACP message, so there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0140] It should be understood that in the embodiment of the present invention, the processor 610 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0141] The memory 620 may include a read-only memory and a random access memory, and provide instructions and data to the processor 610. A portion of the memory 620 may also include a nonvolatile random access memory. For example, the memory 620 may also store information on the device type.

[0142] The bus system 640 may include, in addition to the data bus, a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as the bus system 640 in the figure.

[0143] In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 610 or the instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present invention can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in the processor for execution. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 620, and the processor 610 reads the information in the memory 620 and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it will not be described in detail here.

[0144] Optionally, as an embodiment, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0145] Optionally, as an embodiment, the identification information is carried in a flag bit field in a frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0146] Optionally, as an embodiment, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0147] It should be understood that the first network device 600 for message transmission according to the embodiment of the present invention may correspond to the first network device 300 for message transmission in the embodiment of the present invention, and may correspond to the corresponding subject in the method 100 according to the embodiment of the present invention, and the above and other operations and / or functions of each module in the first network device 600 are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0148] Therefore, the first network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the establishment module of the first network device in the self-organizing network and the second network device according to the MACSec protocol. Through the MACSec channel, the sending module of the first network device sends an ACP message to the second network device. The ACP message is carried in a MACSec frame. The frame header of the MACSec frame carries identification information for identifying the ACP message, so there is no need to configure a routable interface address and a link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use an L3 tunnel, thereby improving efficiency. In addition, the identification information in the frame header of the MACSec frame can be used to distinguish ACP messages from other messages, so that ACP messages can be transmitted between the first network device and the second network device in the self-organizing network.

[0149] like Fig.10As shown, the embodiment of the present invention also provides a second network device 700 for message transmission, and the second network device 700 includes a processor 710, a memory 720, a receiver 730 and a bus system 740. The processor 710, the memory 720 and the receiver 730 are connected through the bus system 740, the memory 720 is used to store instructions, and the processor 710 is used to execute the instructions stored in the memory 720 to control the receiver 730 to receive signals. The processor 710 is used for the second network device to establish a MACSec channel with the first network device according to the media access control security MACSec protocol; the receiver 730 is used for the second network device to receive the MACSec frame sent by the first network device through the MACSec channel. The processor 710 is also used for the second network device to determine the ACP message according to the identification information for identifying the self-organizing control plane ACP message carried in the frame header of the MACSec frame.

[0150] Therefore, the second network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the second network device and the first network device according to the MACSec protocol. Through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the MACSec frame, so that it is not necessary to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use L3 tunnels, thereby improving efficiency. In addition, the ACP message can be distinguished from other messages through the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network through the MACSec channel.

[0151] It should be understood that in the embodiment of the present invention, the processor 710 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0152] The memory 720 may include a read-only memory and a random access memory, and provide instructions and data to the processor 710. A portion of the memory 720 may also include a nonvolatile random access memory. For example, the memory 720 may also store information on the device type.

[0153] The bus system 740 may include, in addition to the data bus, a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as the bus system 740 in the figure.

[0154] In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 710 or the instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present invention can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in the processor for execution. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 720, and the processor 710 reads the information in the memory 720 and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it will not be described in detail here.

[0155] Optionally, as an embodiment, the identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

[0156] Optionally, as an embodiment, the identification information is carried in a flag bit field in a frame header of the MACSec frame, and the flag bit field is a newly added field or a version field.

[0157] Optionally, as an embodiment, the identification information is carried in a MAC address field in a frame header of the MACSec frame.

[0158] It should be understood that the second network device 700 for message transmission according to the embodiment of the present invention may correspond to the second network device 400 for message transmission in the embodiment of the present invention, and may correspond to the corresponding subject in the method 200 according to the embodiment of the present invention, and the above and other operations and / or functions of each module in the second network device 700 are respectively for implementing Figure 5 For the sake of brevity, the corresponding processes of each method in are not repeated here.

[0159] Therefore, the second network device for message transmission in the embodiment of the present invention establishes a MACSec channel between the second network device and the first network device according to the MACSec protocol. Through the MACSec channel, the second network device receives the MACSec frame sent by the first network device, and determines the ACP message according to the identification information in the MACSec frame, so that it is not necessary to configure the routable interface address and the link local address for establishing IPSec on the interface at the same time. The MACSec security mechanism provided for transmitting ACP messages does not need to use L3 tunnels, thereby improving efficiency. In addition, the ACP message can be distinguished from other messages through the identification information in the frame header of the MACSec frame, so that the ACP message can be transmitted between the first network device and the second network device in the self-organizing network through the MACSec channel.

[0160] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0161] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0162] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0163] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0164] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0165] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0166] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A message transmission method, applied in a self-organizing network, characterized in that: The method comprises: The first network device establishes a MACSec channel with the second network device according to the media access control security MACSec protocol; The first network device sends a self-organizing control plane ACP message to the second network device through the MACSec channel, where the ACP message is carried in a MACSec frame, and a frame header of the MACSec frame carries identification information for identifying the ACP message; Before the first network device establishes a MACSec channel with the second network device according to the MACSec protocol, the method further includes: The first network device receives a neighbor discovery AD message from the second network device, where the AD message includes a unique device identifier UDI of the second network device; The first network device compares the UDI whitelist of the first network device with the UDI of the second network device; If the UDI of the second network device belongs to the UDI whitelist of the first network device, the first network device generates a domain certificate according to the UDI of the second network device; The first network device sends the domain certificate to the second network device; Based on the domain certificate, the first network device and the second network device mutually authenticate each other; After the authentication succeeds, the first network device negotiates a message encryption key with the second network device based on the key generated in the authentication.

2. The method according to claim 1, characterized in that The identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

3. The method according to claim 1, characterized in that The identification information is carried in a flag field in a frame header of the MACSec frame, and the flag field is a newly added field or a version field.

4. The method according to claim 1, characterized in that The identification information is carried in a MAC address field in a frame header of the MACSec frame.

5. A message transmission method, applied in a self-organizing network, characterized in that: The method comprises: The second network device establishes a MACSec channel with the first network device according to the media access control security MACSec protocol; The second network device receives a MACSec frame sent by the first network device through the MACSec channel, where the MACSec frame is used to carry an ad hoc control plane ACP message; Before the second network device establishes a MACSec channel with the first network device according to the media access control security MACSec protocol, the method further includes: The second network device sends a neighbor discovery AD message to the first network device, where the AD message includes a unique device identifier UDI of the second network device; and The second network device receives a domain certificate from the first network device according to the UDI of the second network device; Based on the domain certificate, the second network device and the first network device mutually authenticate each other; The method further comprises: The second network device determines the ACP message according to identification information for identifying the ACP message carried in the frame header of the MACSec frame.

6. The method according to claim 5, characterized in that The identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

7. The method according to claim 5, characterized in that The identification information is carried in a flag field in a frame header of the MACSec frame, and the flag field is a newly added field or a version field.

8. The method according to claim 5, characterized in that The identification information is carried in a MAC address field in a frame header of the MACSec frame.

9. A first network device for message transmission, applied in a self-organizing network, characterized in that: The first network device comprises: An establishing module, configured for the first network device to establish a MACSec channel with the second network device according to a media access control security MACSec protocol; A sending module, configured to send a self-organizing control plane ACP message to the second network device through the MACSec channel established by the first network device through the establishment module, wherein the ACP message is carried in a MACSec frame, and the frame header of the MACSec frame carries identification information for identifying the ACP message; The first network device also includes: A receiving module, configured to receive a neighbor discovery AD message from a second network device, wherein the AD message includes a unique device identifier UDI of the second network device; A comparison module, configured to compare the UDI whitelist of the first network device with the UDI of the second network device; A generating module, configured to generate a domain certificate when the UDI of the second network device belongs to the UDI whitelist of the first network device; The sending module is further configured to send the domain certificate to the second network device; The establishing module is further used to mutually authenticate with the second network device based on the domain certificate; The acquisition module is used to negotiate a message encryption key with the second network device based on the key generated in the authentication after the authentication is successful.

10. The first network device according to claim 9, characterized in that: The identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

11. The first network device according to claim 9, characterized in that: The identification information is carried in a flag field in a frame header of the MACSec frame, and the flag field is a newly added field or a version field.

12. The first network device according to claim 9, characterized in that: The identification information is carried in a MAC address field in a frame header of the MACSec frame.

13. A second network device for message transmission, applied in a self-organizing network, characterized in that: The second network device comprises: An establishing module, configured for the second network device to establish a MACSec channel with the first network device according to a media access control security MACSec protocol; A receiving module, configured for receiving a MACSec frame sent by the first network device through the MACSec channel established by the second network device through the establishing module, wherein the MACSec frame is used to carry an ad hoc control plane ACP message; The second network device also includes: A sending module, configured to send a neighbor discovery AD message to the first network device, wherein the AD message includes a unique device identifier UDI of the second network device; The receiving module is further configured to receive a domain certificate from the first network device according to the UDI of the second network device; The establishing module is further used to mutually authenticate with the first network device based on the domain certificate; The second network device also includes: A determination module is used for the second network device to determine the ACP message according to the identification information for identifying the ACP message carried in the frame header of the MACSec frame received by the receiving module.

14. The second network device according to claim 13, characterized in that: The identification information is carried in an Ethernet type field in a frame header of the MACSec frame, and the Ethernet type field is used to indicate that the MACSec frame is used to carry the ACP message.

15. The second network device according to claim 13, characterized in that: The identification information is carried in a flag field in a frame header of the MACSec frame, and the flag field is a newly added field or a version field.

16. The second network device according to claim 13, characterized in that: The identification information is carried in a MAC address field in a frame header of the MACSec frame.

17. A system for message transmission, applied in a self-organizing network, characterized in that: The system comprises: a first network device according to any one of claims 9 to 12, and a second network device according to any one of claims 13 to 16.

Images