A data message processing method, device, storage medium and system

Abstract

The present application provides a method, device, storage medium and system for processing data packets. By applying a micro-segment segment identifier for identifying a micro-segment of a network device in a segment routing network, when a second network device in the segment routing network receives a data packet that needs to be forwarded in the segment routing network, it determines the micro-segment segment identifier of a micro-segment of the corresponding first network device based on the data packet, and carries the micro-segment segment identifier in the process of forwarding the data packet. As a result, when forwarding the data packet in the segment routing network, the network device in the segment routing network can process the data packet based on the micro-segment segment identifier, and implement access control of the data packet based on the micro-segment. The method provided by the present application helps to reduce the configuration complexity of the network.

Description

Technical Field

[0001] The present application relates to the field of communications and is concerned with a method, device, storage medium and system for processing data messages. Background Art

[0002] Micro segmentation (MS): It is a virtual network division method that can implement subnet division based on Internet Protocol (IP) addresses, IP segments, Media Access Control (MAC) addresses, virtual machine (VM) names, containers, operating systems, etc. It can support fine-grained network isolation, such as mutual isolation between different devices belonging to the same virtual local area network (VLAN). Usually, one micro segment corresponds to one endpoint group.

[0003] An endpoint group (EPG) is a collection of endpoints with the same characteristics. The endpoints provide applications or services. For example, the endpoints can be virtual machines. An endpoint group represents a group of applications or services that are grouped into a micro-segment and can have the same security policy level.

[0004] Segment routing (SR) is a protocol designed based on the concept of source routing to forward data packets in the network. In an SR network, a set of ordered segment identifiers are inserted into the data packet by the head node to explicitly specify the forwarding path of the data packet. When SR is applied to the multi-protocol label switching (MPLS) data plane, it is called MPLS-based segment routing (MPLS-SR or SR-MPLS). When SR is applied to the Internet Protocol Version 6 (IPv6) data plane, it is called IPv6-based segment routing (SRv6).

[0005] Segment ID (SID) represents a node or a link. In SRv6, SID is a 128-bit value; in SR-MPLS, SID is a label value. An SRv6 segment ID may include a function part, which indicates that the network device that publishes the segment ID needs to perform the corresponding action.

[0006] Segment ID List (SID List): A list containing a group of segment IDs. After receiving a data message, the head node in the segment routing network inserts a SID List into the data message to explicitly indicate a forwarding path.

[0007] In the prior art, when different micro-segments need to access each other or perform security policy control, and these access and security policies need to act on the segment routing network, a lot of configuration is required, such as configuring the correspondence between all relevant IP addresses in the entire network and micro-segments on each device. The configuration is complicated and, in a sense, basically not feasible. Summary of the invention

[0008] The present application provides a data message processing method and device for implementing access control of data messages in a segment routing network according to micro-segmentation information, thereby reducing configuration complexity.

[0009] In a first aspect, a method for processing a data packet is provided, comprising: a first network device in a segment routing network receives a first data packet, the first data packet includes a first micro-segment segment identifier, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, and the first data packet is a data packet sent to the second network device; the first network device determines a processing action for the first data packet according to the first micro-segment segment identifier; and the first network device performs the processing action on the first data packet.

[0010] The network devices in the SR network can reduce the complexity of network configuration and further reduce the number of table lookups when the network devices implement access control of data packets based on micro-segments by directly obtaining the micro-segment identifier from the received data packets and then performing corresponding processing actions on the data packets based on the micro-segment identifier.

[0011] In one possible manner, the first network device determines a processing action for the first data packet based on the first micro-segment segment identifier, including: the first network device determines a processing action for the first data packet based on a correspondence between the first micro-segment segment identifier and the processing action.

[0012] The network devices in the SR network determine the processing action directly according to the correspondence between the micro-segment segment identifier and the processing action, thereby reducing the number of table lookups when the network devices implement access control of data packets according to the micro-segment.

[0013] In one possible manner, the first network device performs a processing action on the first data packet according to the first micro-segment segment identifier, including: the first network device directly obtains the first micro-segment from the first micro-segment segment identifier; the first network device performs the processing action on the first data packet according to the first micro-segment.

[0014] The network equipment in the SR network directly obtains the micro-segment segment identifier from the received data message, and directly obtains the micro-segment from the micro-segment segment identifier. Then, the network device performs corresponding processing actions on the data message according to the micro-segment, which can reduce the complexity of network configuration and further reduce the number of table lookups when the network device implements access control of data messages according to the micro-segment.

[0015] In one possible embodiment, the first network device and the second network device are the same network device, and the first micro-segment segment identifier includes a functional part. Before the first network device determines the processing action for the first data packet according to the first micro-segment segment identifier, the method also includes: the first network device determines that the functional part is used to indicate: the first network device determines the processing action for the first data packet according to the first micro-segment segment identifier.

[0016] By directly instructing the network device to perform a certain action in the functional part identified by the segment, the configuration of the network can be reduced.

[0017] In one possible manner, the first data packet also includes a second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network. The first network device performs a processing action on the first data packet according to the first micro-segment segment identifier, including: the first network device performs a processing action on the first data packet according to the first micro-segment segment identifier and the second micro-segment segment identifier.

[0018] In one possible manner, the first network device performs the processing action according to the first micro-segment segment identifier and the second micro-segment segment identifier, including: the first micro-segment segment identifier includes a first micro-segment, and the second micro-segment segment identifier includes a second micro-segment; the first network device performs the processing action on the first data packet according to the first micro-segment and the second micro-segment.

[0019] In one possible manner, the first data packet also includes a second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network. The first micro-segment segment identifier and the second micro-segment segment identifier are added to the first data packet by the third network device, and the first network device determines the processing action for the first data packet based on the first micro-segment segment identifier, including: the first network device determines the processing action for the first data packet based on the correspondence between the matching condition and the processing action, and the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

[0020] By carrying the first micro-segment segment identifier and the second micro-segment segment identifier in the data message at the same time, or using the first micro-segment and the second micro-segment as matching conditions for access policy control of the data message, more refined access policy configuration can be performed and the configuration workload can be further reduced.

[0021] In one possible manner, the segment identifier list of the first data message includes the first micro-segment segment identifier.

[0022] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the first data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0023] In a possible manner, the second micro-segment identifier is carried in the source and destination addresses of the message header of the first data message.

[0024] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching label stack of the first data packet.

[0025] The network device carries the first micro-segment segment identifier in a segment identifier list, and carries the segment identifier list in the segment routing header or multi-protocol label switching label stack of the second message, which is beneficial to using the control and forwarding mechanism of the segment routing network and reducing the complexity of implementing the solution of the present invention.

[0026] The network device carries the second micro-segment identifier in the segment identifier list or metadata, which is similar to carrying the micro-segment characteristics of the data message directly in the message. This is beneficial for other devices in the segment routing network to obtain the second micro-segment identifier without the need for complex configuration and multiple table lookups, which is beneficial for reducing the overall overhead of the segment routing network device.

[0027] In a possible manner, the segment routing header of the first data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0028] The network device carries a carrying flag that identifies the carrying mode of the second micro-segment segment identifier in the segment routing header of the first data message, so that the first network device can directly obtain the second micro-segment segment identifier from the position indicated by the carrying flag through the indication of the carrying flag.

[0029] In one possible manner, the processing action includes: forwarding, discarding, marking, redirecting or mirroring.

[0030] By supporting multiple processing actions, the solution of the present invention can match the needs of multiple network services and meet more application scenarios.

[0031] In a possible manner, the second network device and the first network device are the same device.

[0032] In one possible manner, the first network device sends a notification message, the notification message carries the first micro-segment segment identifier; or the first network device sends a border network protocol link status message, the link status message carries the first micro-segment segment identifier; or the first network device sends a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the first micro-segment segment identifier.

[0033] Through the above method, the first network device can publish a micro-segment identifier that identifies its own micro-segment, so that other network devices in the routing network segment can obtain the micro-segment identifier information of the first network device, and notify other network devices in the routing network segment that the first network device has the ability to process data packets according to the micro-segment identifier, as well as the corresponding routing information, etc.

[0034] In one possible manner, when the processing action includes forwarding or marking, the first network device performs the processing action on the first data packet, including: the first network device generates a second data packet, and the second data packet does not include the first micro-segment identifier; the first network device sends the second data packet.

[0035] In one possible manner, when the processing action includes forwarding or marking, the first network device performs a processing action on the first data packet according to the first micro-segment segment identifier, including: the first network device strips the segment identifier list in the first data packet to obtain a second data packet; when the second micro-segment segment identifier is carried in the metadata, the first network device also strips the metadata in the first data packet to obtain the second data packet; the first network device sends the second data packet.

[0036] After receiving the second data packet, the first network device (tail node) strips the SRH in the data packet, and when the second micro-segment segment identifier is carried in the metadata, the metadata is also stripped. The relevant information in the segment routing network is stripped in a manner similar to restoring the forwarded data packet, so as to avoid affecting the subsequent forwarding of the data packet.

[0037] In a possible manner, the second network device and the first network device are different devices.

[0038] In one possible manner, the first data message further includes a micro-segment node segment identifier, where the micro-segment node segment identifier is a segment identifier of the first network device, and the micro-segment node segment identifier is used to instruct the first network device to process the first data message according to the first micro-segment segment identifier.

[0039] In one possible manner, the first network device sends a notification message, the notification message carries the micro-segment node segment identifier; or the first network device sends a border network protocol link status message, the link status message publishes the micro-segment node segment identifier; or the first network device sends a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the micro-segment node segment identifier.

[0040] Through the above optional method, the intermediate node in the segment routing network publishes its micro-segment node segment identifier, so that when the first network device generates a second data packet based on the first data packet, it can carry the micro-segment node segment identifier in the second data packet, so that the intermediate node can also perform processing actions on the data packet according to the carried first and second micro-segment segment identifiers.

[0041] In a second aspect, a method for processing a data packet is provided, including: a first network device in a segment routing network receives a first data packet; the first network device determines a first micro-segment segment identifier based on the first data packet, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, the first data packet does not include the first micro-segment segment identifier, and the first data packet is a data packet sent to the second network device; the first network device determines a processing action for the first data packet based on the first micro-segment segment identifier; the first network device performs the processing action on the first data packet.

[0042] The head node in the SR network can determine the micro-segment segment identifier (also called the destination micro-segment segment identifier) ​​of the tail node to which the data packet is to be sent by following the longest match principle based on the segment identifier table according to the received data packet, without having to configure the relationship between the IP addresses of all devices in the entire network and the micro-segments on the head node, thereby reducing the complexity of network configuration.

[0043] In a possible manner, the first network device determines a processing action for the first data message according to the first micro-segment identifier, including:

[0044] The first network device determines a processing action for the first data message according to a correspondence between the first micro-segment identifier and the processing action.

[0045] In one possible embodiment, before the second network device performs a processing action on the first data packet according to the first micro-segment identifier, the method further includes: the second network device obtains a corresponding relationship, and the corresponding relationship includes a mapping relationship between the first micro-segment identifier and the processing action.

[0046] In one possible manner, the second network device performs a processing action on the first data packet according to the first micro-segment segment identifier, including: the second network device performs the processing action according to the first micro-segment segment identifier and the second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of the second network device; the method also includes: the second network device determines the second micro-segment segment identifier based on the received first data packet.

[0047] In one possible manner, the second network device performs the processing action according to the first micro-segment segment identifier and the second micro-segment segment identifier, including: the first micro-segment segment identifier includes a first micro-segment, and the second micro-segment segment identifier includes a second micro-segment; the second network device performs the processing action on the first data packet according to the first micro-segment and the second micro-segment.

[0048] In this way, the head node uses the above-mentioned destination micro-segment segment identifier and the head node's micro-segment segment identifier (which can be called the source micro-segment segment identifier) ​​as the matching condition for access policy control of the data message; or, the head node network device can also determine the micro-segment corresponding to the source micro-segment segment identifier (which can be called the source micro-segment), as well as the above-mentioned destination micro-segment, and then use the source micro-segment and the destination micro-segment as the matching condition for access policy control of the data message. In this way, more refined access policy control can be performed. In one possible manner, the processing actions include: forwarding, discarding, marking, redirecting, or mirroring.

[0049] By supporting multiple processing actions, the solution of the present invention can match the needs of multiple network services and meet more application scenarios.

[0050] In one possible manner, the first micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data packet according to the first micro-segment segment identifier.

[0051] By directly instructing the network device to perform a certain action in the functional part identified by the segment, the configuration of the network can be reduced.

[0052] In one possible manner, the first network device also determines the second micro-segment segment identifier based on the received first data packet, and the second micro-segment segment identifier is used to identify a micro-segment of the first network device; the first network device determines the processing action for the first data packet based on the first micro-segment segment identifier, including: the first network device determines the processing action for the first data packet based on the correspondence between the matching condition and the processing action, and the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

[0053] By using the first micro-segment identifier and the second micro-segment identifier as matching conditions, a more refined access policy control can be implemented on the data message.

[0054] In one possible manner, when the processing action includes forwarding or marking, the second network device performs a processing action on the first data packet according to the first micro-segment segment identifier, including: the second network device generates a second data packet based on the first data packet, the second data packet includes a segment identifier list, and the segment identifier list includes the first micro-segment segment identifier; the second network device sends the second data packet to the first network device.

[0055] After the second network device determines the first micro-segment segment identifier based on the data message, the method of carrying the first micro-segment segment identifier in the second data message generated by it only requires the second network device, such as: the head node that forwards the first data message in the segment routing network, to carry the first micro-segment segment identifier in subsequent data messages. There is no need for other network devices to determine the first endpoint group segment representation again, thereby reducing the overall network device overhead.

[0056] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the second data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0057] In a possible manner, the second micro-segment identifier is carried in a source and destination address of a message header of the second data message.

[0058] By carrying the second micro-segment identifier in the segment identifier list or metadata, it is similar to carrying the micro-segment characteristics of the data message directly in the message. This is beneficial for other devices in the segment routing network to obtain the second micro-segment identifier without the need for multiple comparison calculations, which is beneficial for reducing the overhead of the overall segment routing network equipment.

[0059] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching (MPLS) label stack of the second data packet.

[0060] By carrying the first micro-segment segment identifier in a segment identifier list, and carrying the segment identifier list in the segment routing header or MPLS label stack of the second message, it is beneficial to continue to use the control and forwarding mechanism of the segment routing network and reduce the complexity of implementing the solution of the present invention.

[0061] In a possible manner, the segment routing header of the second data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0062] By carrying a carrying flag that identifies the carrying mode of the second micro-segment segment identifier in the segment routing header of the second data message, the network device receiving the second data message can directly obtain the second micro-segment segment identifier from the position indicated by the carrying flag through the indication of the carrying flag.

[0063] In one possible manner, the second network device also obtains a micro-segment node segment identifier of a third network device, where the micro-segment node segment identifier is used to instruct the third network device to process the first data packet according to the first micro-segment segment identifier; the segment identifier list also includes the micro-segment node segment identifier.

[0064] By obtaining the micro-segment node segment identifier of a third network device, such as an intermediate node that forwards the first data message in a segment routing network, at the second network device, the second network device can carry the micro-segment node segment identifier in the second data message when generating a second data message based on the first data message, so that the intermediate network node that publishes the micro-segment node segment identifier can also perform processing actions on the data message based on the carried first micro-segment segment identifier.

[0065] In one possible manner, the second network device receives a configuration instruction and obtains the second micro-segment node segment identifier from the configuration instruction; or the second network device generates the second micro-segment node segment identifier.

[0066] In one possible manner, the second network device sends a notification message, the notification message carries the second micro-segment segment identifier; or the second network device sends a border network protocol link status message, the link status message carries the second micro-segment segment identifier; or the second network device sends a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the second micro-segment segment identifier.

[0067] Through the above method, the second network device can also publish a micro-segment identifier that identifies its own micro-segment, so that other network devices in the routing network at this end can also obtain the micro-segment identifier information of the second network device, and notify other network devices in the routing network that the second network device has the ability to process data packets according to the micro-segment identifier, as well as the corresponding routing information, etc.

[0068] In one possible manner, the second micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the first network device determines a processing action for the first data packet according to the second micro-segment segment identifier.

[0069] By directly instructing the network device to perform a certain action in the functional part identified by the segment, the configuration of the network can be reduced.

[0070] In one possible manner, the second network device determines the second micro-segment segment identifier based on the received first data packet, including: the second network device determines the second micro-segment segment identifier based on the source address of the first data packet, or the second network device determines the second micro-segment segment identifier based on the interface that receives the first data packet.

[0071] Through the above method, the network device can determine the second micro-segment identifier corresponding to the first data message in multiple ways, without being limited to just one solution, and the solution has richer application scenarios.

[0072] In one possible manner, the second network device determines the first micro-segment segment identifier according to the first data packet, including: the second network device determines the first micro-segment segment identifier according to a destination address or a differentiated services coding point of the first data packet.

[0073] The method of determining the first micro-segment segment identifier according to the destination address or the differentiated service code point of the first data message does not need to add additional feature information to the present solution to determine the first micro-segment segment identifier, and the solution has a wider application range.

[0074] In one possible manner, the second network device receives a notification message sent by the second network device, and obtains the first micro-segment segment identifier through the notification message; or the second network device receives the first micro-segment segment identifier sent by a controller or a path calculation unit.

[0075] Through the above optional manners, the network device receives the micro-segment segment identifiers issued by other network devices in the segment routing network in a variety of ways, so that the present invention can be used in a variety of segment routing network scenarios.

[0076] According to a third aspect, a first network device is provided, which is applied to a segment routing network, and includes: a receiving unit, used to receive a first data packet, the first data packet includes a first micro-segment segment identifier, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, and the first data packet is a data packet sent to the second network device; a processing unit, used to determine a processing action for the first data packet according to the first micro-segment segment identifier; the processing unit is used to perform the processing action on the first data packet.

[0077] In one possible manner, the processing unit is used to determine the processing action for the first data packet based on the first micro-segment segment identifier, specifically: the processing unit is used to determine the processing action for the first data packet based on the correspondence between the first micro-segment segment identifier and the processing action.

[0078] In one possible embodiment, the first network device and the second network device are the same network device, the first micro-segment segment identifier includes a functional part, and before the processing unit is used to determine the processing action for the first data packet according to the first micro-segment segment identifier, the processing unit is also specifically used to: determine that the functional part is used to indicate: the processing unit determines the processing action for the first data packet according to the first micro-segment segment identifier.

[0079] In one possible embodiment, the first data packet also includes a second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network. The processing unit is used to perform processing actions on the first data packet according to the first micro-segment segment identifier. Specifically, the processing unit is used to perform processing actions on the first data packet according to the first micro-segment segment identifier and the second micro-segment segment identifier.

[0080] In one possible manner, the segment identifier list of the first data message includes the first micro-segment segment identifier.

[0081] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the first data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0082] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching label stack of the second data packet.

[0083] In a possible manner, the segment routing header of the first data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0084] In a possible manner, the first network device further includes a sending unit, and the processing action includes: forwarding, discarding, marking, redirecting or mirroring.

[0085] In a possible manner, the second network device and the first network device are the same device.

[0086] In one possible manner, the sending unit is used to send a notification message, the notification message carries the first micro-segment segment identifier; or the sending unit is used to send a border network protocol link status message, the link status message carries the first micro-segment segment identifier; or the sending unit is used to send a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the first micro-segment segment identifier.

[0087] In one possible embodiment, the first network device also includes a sending unit, and when the processing action includes forwarding or marking, the processing unit performs the processing action on the first data packet, specifically: the processing unit generates a second data packet, and the second data packet does not include the first micro-segment identifier; the sending unit is used to send the second data packet.

[0088] In one possible manner, when the processing action includes forwarding or marking, the processing unit is used to perform a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processing unit is used to strip the segment identifier list in the first data packet to obtain the second data packet; when the second micro-segment segment identifier is carried in the metadata, the processing unit is also used to strip the metadata in the first data packet to obtain the second data packet; the first network device sends the second data packet.

[0089] In a possible manner, the second network device and the first network device are different devices.

[0090] In one possible manner, the first data message further includes a micro-segment node segment identifier, where the micro-segment node segment identifier is a segment identifier of the first network device, and the micro-segment node segment identifier is used to instruct the first network device to process the first data message according to the first micro-segment segment identifier.

[0091] In one possible manner, the first network device and the second network device are different devices, and the first data packet also includes a micro-segment node segment identifier, and the micro-segment node segment identifier is a segment identifier of the first network device. The micro-segment node segment identifier includes a functional part, and the functional part is used to indicate: the processing unit determines a processing action for the first data packet according to the first micro-segment segment identifier.

[0092] In one possible manner, the sending unit is used to: send a notification message, the notification message carries the micro-segment node segment identifier; or send a border network protocol link status message, the link status message publishes the micro-segment node segment identifier; or send a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the micro-segment node segment identifier.

[0093] In a fourth aspect, a second network device is provided, which is applied to a segment routing network, including:

[0094] A receiving unit, used to receive a first data packet; a processing unit, used to determine a first micro-segment segment identifier based on the first data packet, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, the first data packet does not include the first micro-segment segment identifier, and the first data packet is a data packet sent to the second network device; the processing unit is also used to determine a processing action for the first data packet based on the first micro-segment segment identifier; the processing unit is also used to perform the processing action on the first data packet.

[0095] In one possible embodiment, the processing unit is also used to determine the processing action for the first data packet based on the first micro-segment segment identifier, specifically: the processing unit is used to determine the processing action for the first data packet based on the correspondence between the first micro-segment segment identifier and the processing action.

[0096] In one possible manner, the first micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data packet according to the first micro-segment segment identifier.

[0097] In one possible manner, the processing unit is used to perform a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processing unit is used to perform the processing action according to the first micro-segment segment identifier and the second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of the second network device; the processing unit is also used to determine the second micro-segment segment identifier based on the received first data packet.

[0098] In one possible manner, the processing action includes: forwarding, discarding, marking, redirecting or mirroring.

[0099] In one possible embodiment, the second network device also includes a sending unit, and when the processing action includes forwarding or marking, the processing unit is also used to perform the processing action on the first data packet, specifically: the processing unit is used to generate a second data packet based on the first data packet, and the second data packet includes the first micro-segment identifier; the sending unit is used to send the second data packet to the second network device.

[0100] In one possible manner, the second micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the first network device determines a processing action for the first data packet according to the second micro-segment segment identifier.

[0101] In one possible embodiment, the processing unit also includes a sending unit, and when the processing action includes forwarding or marking, the processing unit performs a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processing unit is used to generate a second data packet based on the first data packet, the second data packet includes a segment identifier list, and the segment identifier list includes the first micro-segment segment identifier; the sending unit is used to send the second data packet to the first network device.

[0102] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the second data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0103] In one possible manner, the receiving unit is also used to receive a micro-segment node segment identifier of a third network device, and the micro-segment node segment identifier is used to instruct the third network device to process the first data packet according to the first micro-segment segment identifier; the segment identifier list also includes the micro-segment node segment identifier.

[0104] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching (MPLS) label stack of the second data packet.

[0105] In a possible manner, the segment routing header of the second data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0106] In a possible manner, the receiving unit is further configured to receive a configuration instruction, and obtain the second micro-segment segment identifier from the configuration instruction; or the processing unit is further configured to generate the second micro-segment node segment identifier.

[0107] In one possible manner, the sending unit is used to send a notification message, the notification message carries the second micro-segment segment identifier; or the sending unit is used to send a border network protocol link status message, the link status message carries the second micro-segment segment identifier; or the sending unit is used to send a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the second micro-segment segment identifier.

[0108] In one possible embodiment, the processing unit is also used to determine the second micro-segment segment identifier based on the received first data packet, specifically: the processing unit is used to determine the second micro-segment segment identifier based on the source address of the first data packet, or the processing unit is used to determine the second micro-segment segment identifier based on the interface that receives the first data packet.

[0109] In one possible manner, the processing unit is used to determine the first micro-segment segment identifier according to the first data packet, specifically: the processing unit is used to determine the first micro-segment segment identifier according to the destination address or differentiated service coding point of the first data packet.

[0110] In one possible embodiment, the receiving unit is further used to receive the first micro-segment segment identifier in a notification message sent by the second network device; or the receiving unit is further used to receive the first micro-segment segment identifier sent by a controller or a path calculation unit.

[0111] In a fifth aspect, a first network device is provided, which is applied to a segment routing network, comprising: a communication interface, a memory and a processor; the communication interface is used to receive a first data packet, the first data packet includes a first micro-segment segment identifier, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, and the first data packet is a data packet sent to the second network device; the processor is used to determine a processing action on the first data packet according to the first micro-segment segment identifier; the processor performs the processing action on the first data packet.

[0112] In one possible manner, the processor determines the processing action for the first data message according to the first micro-segment segment identifier, including: the processor determines the processing action for the first data message according to the correspondence between the first micro-segment segment identifier and the processing action.

[0113] In one possible embodiment, the first network device and the second network device are the same network device, and the first micro-segment segment identifier includes a functional part. Before the processor determines the processing action for the first data packet based on the first micro-segment segment identifier, the processor is also used to: determine that the functional part is used to indicate: the first network device determines the processing action for the first data packet based on the first micro-segment segment identifier.

[0114] In one possible embodiment, the first data packet also includes a second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network. The processor is used to perform processing actions on the first data packet according to the first micro-segment segment identifier. Specifically, the processor is also used to perform processing actions on the first data packet according to the first micro-segment segment identifier and the second micro-segment segment identifier.

[0115] In one possible manner, the segment identifier list of the first data message includes the first micro-segment segment identifier.

[0116] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the first data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0117] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching (MPLS) label stack of the second data packet.

[0118] In a possible manner, the segment routing header of the first data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0119] In one possible manner, the processing action includes: forwarding, discarding, marking, redirecting or mirroring.

[0120] In a possible manner, the second network device and the first network device are the same device.

[0121] In one possible embodiment, the communication interface is also used to send a notification message, which carries the first micro-segment segment identifier; or the communication interface is also used to send a border network protocol link status message, which carries the first micro-segment segment identifier; or the communication interface is also used to send a path calculation unit communication protocol message, which carries the first micro-segment segment identifier.

[0122] In one possible manner, when the processing action includes forwarding or marking, the processor is used to perform a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processor is used to strip the segment identifier list in the first data packet to obtain the second data packet; when the processor determines that the second micro-segment segment identifier is carried in the metadata, the processor is also used to strip the metadata in the first data packet to obtain the second data packet; the communication interface is also used to send the second data packet.

[0123] In a possible manner, the second network device and the first network device are different devices.

[0124] In one possible manner, the first data message further includes a micro-segment node segment identifier, where the micro-segment node segment identifier is a segment identifier of the first network device, and the micro-segment node segment identifier is used to instruct the first network device to process the first data message according to the first micro-segment segment identifier.

[0125] In one possible manner, the communication interface is also used to send a notification message, which carries the micro-segment node segment identifier; or the communication interface is also used to send a border network protocol link status message, which publishes the micro-segment node segment identifier; or the communication interface is also used to send a path calculation unit communication protocol message, which carries the micro-segment node segment identifier.

[0126] In a sixth aspect, a second network device is provided, which is applied to a segment routing network and includes: a communication interface, a memory, and a processor; the communication interface is used to receive a first data packet; the processor is used to determine a first micro-segment segment identifier based on the first data packet, the first micro-segment segment identifier is used to identify a micro-segment of the second network device in the segment routing network, the first data packet does not include the first micro-segment segment identifier, and the first data packet is a data packet sent to the second network device; the processor is also used to determine a processing action for the first data packet based on the first micro-segment segment identifier; the processor is also used to perform the processing action on the first data packet.

[0127] In one possible manner, the processor is used to determine the processing action for the first data packet based on the first micro-segment segment identifier, specifically: the processor determines the processing action for the first data packet based on the correspondence between the first micro-segment segment identifier and the processing action.

[0128] In one possible manner, the processor is used to perform a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processor performs the processing action according to the first micro-segment segment identifier and the second micro-segment segment identifier, and the second micro-segment segment identifier is used to identify a micro-segment of the second network device; the processor is also specifically used to: determine the second micro-segment segment identifier based on the received first data packet.

[0129] In one possible embodiment, the communication interface is also used to receive a notification message sent by the second network device, and the processor is also used to obtain the first micro-segment segment identifier from the notification message; or the communication interface is also used to receive a control message sent by a controller or a path calculation unit, and the processor is also used to obtain the first micro-segment segment identifier from the control message.

[0130] In one possible manner, the processing action includes: forwarding, discarding, marking, redirecting or mirroring.

[0131] In one possible manner, when the processing action includes forwarding or marking, the processor is used to perform a processing action on the first data packet according to the first micro-segment segment identifier, specifically: the processor is used to generate a second data packet based on the first data packet, the second data packet includes a segment identifier list, and the segment identifier list includes the first micro-segment segment identifier; the communication interface is used to send the second data packet to the first network device.

[0132] In one possible manner, the segment identifier list also includes the second micro-segment segment identifier, or the second data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

[0133] In a possible manner, the segment identifier list is carried in a segment routing header or a multi-protocol label switching (MPLS) label stack of the second data packet.

[0134] In a possible manner, the segment routing header of the second data message further includes a carrying flag, and the carrying flag identifies a carrying method of the second micro-segment segment identifier.

[0135] In one possible manner, the processor is also used to obtain a micro-segment node segment identifier of a third network device, and the micro-segment node segment identifier is used to instruct the third network device to process the first data packet according to the first micro-segment segment identifier; the segment identifier list also includes the micro-segment node segment identifier.

[0136] In one possible manner, the communication interface is used to receive a configuration instruction, and the processor is used to obtain the second micro-segment segment identifier from the configuration instruction; or the processor is used to generate the second micro-segment node segment identifier.

[0137] In one possible manner, the sending unit is used to send a notification message, the notification message carries the second micro-segment segment identifier; or the sending unit is used to send a border network protocol link status message, the link status message carries the second micro-segment segment identifier; or the sending unit is used to send a path calculation unit communication protocol message, the path calculation unit communication protocol message carries the second micro-segment segment identifier.

[0138] The various possible implementations of the sixth aspect mentioned above, as well as the various possible implementations of the sixth aspect and the sixth aspect mentioned above, can be reasonably combined.

[0139] In a seventh aspect, a network device is provided, the network device comprising: a main control board and an interface board, and further, a switching network board. The network device is used to execute the method in the first aspect or any possible implementation of the first aspect. Specifically, the network device includes a module for executing the method in the first aspect or any possible implementation of the first aspect.

[0140] In an eighth aspect, a network device is provided, the network device comprising: a main control board and an interface board, and further, a switching network board. The network device is used to execute the method in the second aspect or any possible implementation of the second aspect. Specifically, the network device includes a module for executing the method in the second aspect or any possible implementation of the second aspect.

[0141] In the ninth aspect, a network system is provided, which includes a first network device and a second network device, wherein the first network device is the first network device provided by any optional method of the third aspect or the fifth aspect, and the first network device is the second network device provided by any optional method of the fourth aspect or the sixth aspect.

[0142] In the tenth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and the instruction is loaded and executed by a processor for a method for processing data packets as provided in the first aspect and any optional method of the first aspect, or a method for processing data packets as provided in the second aspect and any optional method of the second aspect.

[0143] In an eleventh aspect, a computer program is provided, wherein the computer program includes a method for executing the method described in the first aspect or any optional manner of the first aspect.

[0144] In a twelfth aspect, a computer program is provided, wherein the computer program includes a method for executing the method described in the second aspect or any optional method of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0145] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings used in the embodiments. Obviously, the following drawings are only drawings of some embodiments of the present invention. For ordinary technicians in this field, other technical solutions and drawings that can also implement the present invention can be obtained based on these drawings without creative work. These technical solutions and drawings should also be considered to be within the scope of the present invention.

[0146] Figure 1 A schematic diagram of an application scenario of a network system in an embodiment of the present application;

[0147] Figure 2 A schematic diagram of an application scenario in an embodiment of the present application;

[0148] Figure 3a A flow chart of a method for processing a data message provided in an embodiment of the present application;

[0149] Figure 3b A flow chart of a method for processing a data message provided in an embodiment of the present application;

[0150] Figure 4a A flow chart of a method for processing a data message provided in an embodiment of the present application;

[0151] Figure 4b A flow chart of a method for processing a data message provided in an embodiment of the present application;

[0152] Figure 5 A schematic diagram of a first type length value TLV provided in an embodiment of the present application;

[0153] Figure 6 A schematic diagram of the composition of a micro-segment identification provided in an embodiment of the present application;

[0154] Figure 7 A schematic diagram of a segment routing header provided in an embodiment of the present application;

[0155] Figure 8 A schematic diagram of a metadata TLV provided in an embodiment of the present application;

[0156] Fig. 9 A schematic diagram of a flag bit in a segment routing header provided in an embodiment of the present application;

[0157] Fig.10 A schematic diagram of a second type length value TLV provided in an embodiment of the present application;

[0158] Fig.11 A schematic diagram of the structure of a second network device provided in an embodiment of the present application;

[0159] Fig.12 A schematic diagram of a first network device structure provided in an embodiment of the present application;

[0160] Fig.13 A schematic diagram of a network device structure provided in an embodiment of the present application;

[0161] Fig.14 A schematic diagram of a network device structure provided in an embodiment of the present application;

[0162] Fig.15 A schematic diagram of a network system provided for an embodiment of the present application. DETAILED DESCRIPTION

[0163] In order to enable those skilled in the art to better understand the solutions of the present invention, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings and implementation modes.

[0164] In this application, the terms "first", "second", "third", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "third", nor are there any limitations on quantity and execution order.

[0165] The following explains the terms involved in this application:

[0166] Segment routing header (SRH): IPv6 packets are composed of IPv6 standard header + extension header (0...n) + payload. In order to implement SRv6 based on the IPv6 forwarding plane, a new IPv6 extension header is added, called the SRH extension header. This extension header specifies an IPv6 explicit path and stores the IPv6 Segment List information. Its function is the same as the Segment List in SR MPLS. The head node adds an SRH extension header to the IPv6 packet, and the intermediate node can forward the IPv6 packet according to the path information contained in the SRH extension header. For example, when forwarding IPv6 packets, a network device that supports SRv6 will query the local segment identification table (local SID table) according to the destination address (Destination Address, DA) in the data packet. When the destination address of the data packet matches any SID in the local segment identification table, the operation corresponding to the policy is performed according to the SID-related policy in the local segment identification table. For example, the operation corresponding to the policy can forward the data packet from the outbound interface specified by the SID); if the destination address of the data packet does not match any SID in the local segment identification table, the IPv6 routing table is checked again, and the longest match forwarding is performed according to the IPv6 routing table.

[0167] Head Node: The starting node of the SR forwarding path, responsible for encapsulating segment identifiers.

[0168] Micro-segment segment identifier: A segment identifier used to identify a micro-segment of a network device in a segment routing network, corresponding to an endpoint group. The micro-segment segment identifier instructs the network device that publishes the micro-segment segment identifier to perform a message processing operation based on the micro-segment segment identifier or micro-segment.

[0169] Micro-segment node segment identifier: A segment identifier used to identify a network device in a segment routing network. The micro-segment node segment identifier instructs the network device that publishes the micro-segment node segment identifier to perform a message processing operation based on the micro-segment segment identifier or micro-segment.

[0170] In one possible way, if it is necessary to process packets according to micro-segments in a segment routing network, it is necessary to configure the relationship between IP addresses and micro-segments on each device in the segment routing network, as well as the processing actions corresponding to the micro-segments. For example, a network includes network device 1 and network device 2, network device 1 is connected to VM1, network device 2 is connected to VM2, and the network between network device 1 and network device 2 is an SR network. When VM1 sends data packet A to VM2, network device 1 receives the data packet A. Network device 1 needs to first look up the table according to the destination address in data packet A (that is, the address of VM2) to obtain the micro-segment corresponding to the address of VM2, and then look up the table according to the micro-segment to obtain the corresponding processing action (such as modifying the priority), and then forward the marked data packet A to network device 2, and network device 2 also needs to perform similar actions as network device 1. Sometimes the intermediate device between network device 1 and network device 2 also needs to execute similar policies according to micro-segments, which will result in configuration work for many devices. Moreover, when a large number of data packets are transmitted between network device 1 and network device 2, it may involve many devices (including network device 1, network device 2 and intermediate devices) to look up tables multiple times to obtain the processing strategy for these data packets. In some special scenarios, when there are IP address conversions of multiple network segments, such as: the IP address of the VM is a private network segment IP address, and the routing network address in the segment routing network is a public network IP address, it is impossible to configure the correspondence between micro-segments and IP addresses on the network devices in the segment routing network, and it is impossible to process data packets according to micro-segments.

[0171] The following is an example of an application scenario of the present application. Figure 1 , which is a schematic diagram of an application scenario of a network system according to an embodiment of the present application. Figure 1 In the scenario shown, network device 101, network device 102, network device 103, and network device 104 belong to the same SR network, wherein network device 101, network device 102, network device 103, and network device 104 may be router devices, or switches or any other devices with SR routing functions, and the device may be in the form of a physical device or a virtualized device with SR routing functions, which is not specifically limited in this application.

[0172] Those skilled in the art will appreciate that the number of network devices in the application scenario may be more or less. For example, the network devices may be dozens or hundreds, or more. The embodiment of the present application does not limit the number and type of network devices.

[0173] exist Figure 1In the scenario shown, network device 101 is connected to virtual machines (VM) 1, VM2, VM3, and VM4, and network device 101 is also connected to network device 102 and network device 104; network device 102 is connected to network device 101 and network device 103; network device 104 is connected to network device 101 and network device 103; network device 103 is connected to VM5, VM6, VM7, and VM8, and network device 103 is also connected to network device 102 and network device 104. Among them, VM1 and VM2 belong to the same EPG: EPG1, VM3 and VM4 belong to the same EPG: EPG2, VM5 and VM6 belong to the same EPG: EPG3, and VM7 and VM8 belong to the same EPG: EPG4.

[0174] The network runs the SR protocol: the network can be either an SR-MPLS network or an SRv6 network. Figure 1 In the illustrated scenario, both network device 101 and network device 103 support SR, and network device 102 and network device 104 may support SR or may not support SR.

[0175] Optionally, the application scenario may also include a controller or a path calculation unit, which may be connected to each network device via a wireless network or a wired network, and the controller or the path calculation unit may be used to determine a corresponding forwarding path for a data message that needs to be forwarded in the routing network. The controller or the path calculation unit may be at least one of a server, multiple servers, a cloud computing platform, and a virtualization center. When there are multiple controllers, there may be at least two controllers for providing different services, and / or there may be at least two controllers for providing the same service, such as providing the same service in a load balancing manner, which is not specifically limited in this embodiment.

[0176] Those skilled in the art will understand that Figure 1 The scenario shown does not limit the specific connection method between network devices 101 and 103 and their corresponding VMs. They can be directly connected or connected to the corresponding VMs through other network devices, such as switches, firewalls, etc. These other network devices do not belong to the SR network, that is, they do not run the corresponding SR functions. Figure 2As shown, network device 101 is connected to VM1 and VM3 through network device 201, and network device 101 is connected to VM2 and VM4 through network device 202. Network device 103 is connected to VM5 and VM6 through network device 203, and network device 103 is connected to VM7 and VM8 through network device 204. As reflected in network device 101 and network device 103, the way of dividing the corresponding micro-segments for endpoint groups is not limited to the specific connection method, that is, the micro-segmentation can be divided not only according to their own physical or virtual interfaces, but also based on the characteristics of the final endpoint group, such as IP address, or differentiated services code point (DSCP), or a combination of the two or more characteristics.

[0177] See also Figure 3a , which is a flow chart of a method for processing a data message provided in an embodiment of the present application. Figure 3a As shown, the interaction of the method mainly includes a first network device and a second network device. The second network device may be the head node of the forwarding path of the data message in the segment routing network, and the first network device may be the tail node in the forwarding path. Figure 1 In the application scenario shown, the network device 101 and the network device 103 may be the second network device and the first network device, respectively.

[0178] The following, combined Figure 1 and Figure 3a The steps and optional methods mainly included in the method are explained. For ease of understanding, the network device 101 is used as the second network device, and the network device 103 is used as the first network device as an example to explain the embodiment of the method. It should be understood that this is only an example, and those skilled in the art can also refer to this embodiment and make similar replacements and applications. This application will not give examples one by one.

[0179] The method mainly includes the following steps:

[0180] S301: The network device 103 publishes a first micro-segment identifier.

[0181] The micro-segment segment identifier corresponds to a micro-segment of the network device and can be expressed as End.XTEpg SID, where End stands for endpoint, X stands for crossing, T stands for table lookup, Epg stands for endpoint group, and SID stands for segment identifier. The micro-segment segment identifier can meet the format of IPv6 address or MPLS label.

[0182] The first micro-segment segment identifier corresponds to a micro-segment of the network device 103. In an example, the micro-segment is EPG3, and its corresponding micro-segment segment identifier can be a value in the IPv6 address format. The endpoint group corresponding to the micro-segment includes VM5 and VM6. Those skilled in the art should understand that this is only an example, and the endpoint group corresponding to the micro-segment EPG3 can also be VM5 and VM7. The division of micro-segments can be based on specific IP addresses, IP prefixes, and specific requirements of applications or services, and this application does not make specific limitations. It should be understood that in some cases, the first micro-segment segment identifier may also correspond to multiple micro-segments of the network device 103.

[0183] The network device 103 publishes the first micro-segment identifier in three or more of the following publishing methods:

[0184] Method 1: The network device 103 sends a notification message, which carries the first micro-segment identifier.

[0185] The notification message can be a Border Gateway Protocol (Border Gateway Protocol, BGP) message, or a Border Gateway Protocol Ethernet Virtual Private Network (Border Gateway Protocol Ethernet VirtualPrivate Network, BGP EVPN) message, or an Interior Gateway Protocol (Interior Gateway Protocol, IGP) message, and this application does not make specific limitations.

[0186] Optionally, the first micro-segment identifier in the notification message is carried in its first type length value (typelength value, TLV). TLV is a coding format mainly defined by three types of information: type, length, and value. The format of the first TLV is shown as follows: Figure 5 As shown. The type field identifier in the figure indicates the type of the first TLV. The value of the type field can identify that the first TLV is a TLV used to publish the End.XTEpg SID. The value of the type field can be the type of a new application for publishing a micro-segment segment identifier, for example, it can be 90. The value of the length field identifies the length of the first TLV. The reserved field is reserved for subsequent extensions, such as for identifying a forwarding path. The micro-segment segment identifier field is used to carry a micro-segment segment identifier.

[0187] Method 2: The network device 103 may publish the first micro-segment identifier through the BGP link state protocol (Border Gateway Protocol-link state, BGP-LS).

[0188] Specifically, the network device 103 may send the first micro-segment segment identifier to the controller via BGP-LS. The controller may receive the first micro-segment segment identifier sent by the network device 103 via BGP-LS and send the first micro-segment segment identifier to the network device 101 .

[0189] Method three: the network device 103 may publish the first micro-segment identifier through the Path Computation Element Communication Protocol (PCEP).

[0190] Specifically, the network device 103 can send the first micro-segment segment identifier to the controller or path computation element (PCE) through PCEP. The controller or PCE can receive the first micro-segment segment identifier sent by the network device 103 through PCEP and send the first micro-segment segment identifier to the network device 101.

[0191] Before the network device 103 issues the first micro-segment segment identifier, the network device 103 needs to obtain the first micro-segment segment identifier. Regarding how the network device 103 obtains the micro-segment segment identifier, in some possible embodiments, the network device 103 may automatically assign at least one micro-segment segment identifier, or may manually configure at least one micro-segment segment identifier. Specifically, the method of obtaining the micro-segment segment identifier may include any one or more of the following methods 1 or 2.

[0192] Method 1: The network device 103 allocates a micro-segment identifier to the corresponding micro-segment or endpoint group.

[0193] In one example, the network device 103 may allocate a micro-segment segment identifier to each micro-segment or each endpoint group, and different micro-segment segment identifiers may be allocated to different endpoint groups / micro-segments, so that each allocated micro-segment segment identifier corresponds to a micro-segment or an endpoint group. In another example, the network device 103 may also allocate the same micro-segment segment identifier to multiple micro-segments or multiple endpoint groups, so that one allocated micro-segment segment identifier corresponds to multiple micro-segments or multiple endpoint groups. Among them, the network device 103 may store a segment identifier space, and may select an unoccupied micro-segment segment identifier from the segment identifier space, and allocate the micro-segment segment identifier to the micro-segment or endpoint group.

[0194] Method 2: The network device 103 receives a configuration instruction, and the network device 103 obtains the correspondence between the micro-segment identifier and one or more micro-segments or endpoint groups from the configuration instruction. The configuration instruction may be triggered by a user's configuration operation on the network device 103, or may be triggered by a network management or controller.

[0195] In one example, applied to Figure 1 In the scenario shown, the correspondence between the micro-segment identifiers obtained by the network device 103 and the micro-segments can be shown in Table 1 below.

[0196] Table 1

[0197] Micro-segment segment identification Micro-segment identification End.XTEpg SID3 EPG3 End.XTEpg SID4 EPG4

[0198] When the network device 103 has a correspondence between the micro-segment segment identifier and the micro-segment as shown in Table 1, there is also a correspondence between the micro-segment and the endpoint group, and the endpoint group can be defined by the IP address of the endpoint device, the interface connecting the endpoint group device and the network device 103, the MAC address, and other information. The following example uses the IP address of the endpoint device to represent the endpoint group: For example, VM5 and VM6 can be represented by the same IP address prefix A1::3:1 / 80, and VM7 and VM8 can be represented by the same IP address prefix A1::3:2 / 80 as shown in Table 2 below.

[0199] Table 2

[0200] Micro-segment identification Endpoint Groups EPG3 A1::3:1 / 80 EPG4 A1::3:2 / 80

[0201] The above Table 1 and Table 2 only represent logical concepts. In implementation, Table 1 and Table 2 can be combined into one table.

[0202] In another example, applied to Figure 1 In the scenario shown, the correspondence between the micro-segment identifier obtained by the network device 103 and the endpoint group can be shown in Table 3 below. In this example, the endpoint group is defined by the interface through which the endpoint group device is connected to the network device 103, which can be a virtual sub-interface or a physical interface. The following takes the virtual sub-interface as an example: End.XTEpg SID3 corresponds to the endpoint group EPG3, and the interface through which the network device 103 is connected to the endpoint group EPG3 is its virtual interface 1, and its name is vInf103-1; End.XTEpg SID4 corresponds to the endpoint group EPG4, and the port through which the network device 103 is connected to the endpoint group EPG4 is its virtual interface 2, and its name is vInf103-2.

[0203] Table 3

[0204] Micro-segment segment identification Endpoint Groups End.XTEpg SID3 vInf103-1 End.XTEpg SID4 vInf103-2

[0205] In Table 3, the micro-segment identifier can also be used as an identifier of a micro-segment, indicating a micro-segment.

[0206] It should be understood that the above are only examples of the correspondence between micro-segmentation segment identifiers and micro-segments or endpoint groups. In the specific implementation process, the correspondence between micro-segmentation segment identifiers and micro-segments or endpoint groups can be obtained based on the above multiple methods, such as based on IP prefixes, or a specific combination of IP addresses, or the interface connected to the endpoint and the network device, etc.

[0207] In an SRv6 example, the specific value of the micro-segment identifier includes the following two parts: location information (Locator) and function (Function): SRv6 SID is in the form of an IPv6 address. SRv6 SID can be composed of two parts: location information and function. The format is: location information: function. Among them, the location information occupies the high bits of the IPv6 address, and the function occupies the low bits of the IPv6 address. Among them, the location information can have a positioning function and can be unique in the SR domain. The function represents the instructions of the device. These instructions are pre-set by the device. The function part is used to instruct the SRv6 SID generation device to perform corresponding functional operations.

[0208] Figure 6 An example of another SRv6 micro-segment segment identifier is shown. In this example, the micro-segment segment identifier is 128 bits in total, which is divided into three parts: location information: function: parameter segment, wherein the location information part occupies high bits 0-64, and the function part occupies the middle bits, indicating that the generating device of the micro-segment segment identifier, such as the network device 103, performs a corresponding table lookup based on the micro-segment segment identifier to determine the processing action of the message corresponding to the micro-segment segment identifier, and finally performs the processing action on the message and generates the corresponding segment routing header or other related operations. The parameter segment part can define some message flow and service information.

[0209] S303: The network device 101 obtains a first micro-segment identifier.

[0210] Corresponding to the manner in which the network device 103 issues the first micro-segment segment identifier, the manner in which the network device 101 obtains the first micro-segment segment identifier may be the following two optional manners:

[0211] Method 1: The network device 101 receives a notification message sent by the network device 103 , and the message carries the first micro-segment identifier.

[0212] Specifically, when the network device 103 sends the first micro-segment identifier through a BGP message, the network device 101 receives the BGP message sent by the network device 103 and obtains the first micro-segment identifier from the message; when the network device 103 sends the first micro-segment identifier through an IGP message, the network device 101 receives the IGP message sent by the network device 103 and obtains the first micro-segment identifier from the message.

[0213] Specifically, when the first micro-segment identifier is carried in a first TLV of a BGP message or an IGP message, the network device 101 obtains the first micro-segment identifier from the first TLV of the BGP message or the IGP message.

[0214] Mode 2: The network device 101 receives a first micro-segment identifier sent from a controller or a path calculation unit.

[0215] Specifically, when the network device 103 sends the first micro-segment segment identifier to the controller through BGP-LS, the controller can receive the first micro-segment segment identifier sent by the network device 103 through the BGP-LS protocol, and send the first micro-segment segment identifier to the network device 101. When the network device 103 sends the first micro-segment segment identifier to the controller or PCE by sending a PCEP message, the controller or PCE can receive the first micro-segment segment identifier sent by the network device 103, and send the first micro-segment segment identifier to the network device 101. The time when the controller or PCE executes to send the first micro-segment segment identifier to the network device 101 can be immediately after receiving the first micro-segment segment identifier, or it can be sent to the network device 101 after a period of time, or when the network device 101 requests a forwarding path from the controller or PCE.

[0216] S305: The network device 101 receives a first data packet, and determines a first micro-segment identifier according to the first data packet, wherein the first data packet does not include the first micro-segment identifier.

[0217] In a Figure 1 In the example shown, when VM1 and VM5 need to communicate, VM1 sends a data message (ie, a first data message) to VM5. After receiving the first data message sent by VM1, the network device 101 can determine the first micro-segment identifier according to the first data message.

[0218] The manner in which the network device 101 determines the first micro-segment identifier according to the first data message includes:

[0219] Method 1: The network device 101 determines the first micro-segment identifier according to the destination IP address of the first data message. For example, there may be a corresponding relationship as shown in Table 4 below on the network device 101. Then, when the destination IP address of the first data message is A1::3:1 / 80, the network device 101 obtains the first micro-segment identifier as End.XTEpg SID3 according to a matching principle (for example, the longest matching principle).

[0220] Table 4

[0221] Destination IP prefix Micro-segment segment identification A1::3:1 / 80 End.XTEpg SID3 A1::3:2 / 80 End.XTEpg SID4

[0222] The corresponding relationship shown in Table 4 may be obtained by iterative calculation by the network device 101 based on the information such as the route advertisement message issued by the network device 103, or may be obtained by the network device 101 receiving the forwarding path planning information issued by the controller or the path calculation unit.

[0223] Method 2: After receiving the first data packet, the network device 101 requests a forwarding path to the destination IP of the data packet from the controller or the path calculation unit. After receiving the request, the controller or the path calculation unit calculates a forwarding path based on the obtained network topology or other information and sends it to the network device 101. For example, the forwarding path from VM1 to VM5 calculated by the controller or the path calculation unit for the network device 101 is network device 102->network device 103, and the specific segment identifier list may be: End.SID102, End.XTEpg SID3. Among them, End.SID102 is the segment identifier of the network device 102, and End.XTEpg SID3 is the micro-segment segment identifier of the network device 103. The network device 101 determines the first micro-segment segment identifier as End.XTEpg SID3 based on the forwarding path.

[0224] Method three: the network device 101 determines the first micro-segment identifier according to the differentiated services code point of the first data message.

[0225] S307: The network device 101 determines a processing action for the first data message according to the first micro-segment identifier.

[0226] In one possible manner, the network device 101 can be configured to determine whether it is necessary to search for or execute a processing strategy. The processing strategy here can also be considered as a corresponding relationship. When the network device is configured not to search for or execute a processing strategy, the processing action is to forward the first data packet. The network device 101 determines, based on the configuration, that the processing action for the first data packet is forwarding.

[0227] In one possible manner, the network device 101 may be configured to search for a processing strategy for the first data message and process it according to the processing strategy. Therefore, in one possible implementation manner, before the network device 101 determines the processing action for the first data message according to the first micro-segment segment identifier, the network device 101 also needs to obtain a processing strategy, which includes a matching condition and a processing action. In one possible implementation manner, the processing strategy is stored in a group-based access policy table (group based policy, GBP) of the network device 101. Among them, the matching condition may include the first micro-segment segment identifier, that is, the network device determines the first micro-segment segment identifier according to the received data message, such as the first micro-segment segment identifier End.XTEpg SID3 as described above. The processing actions in the processing strategy include one or more of the following: forwarding, discarding, marking, redirecting and mirroring. Among them, marking is a special forwarding, that is, the network device marks the data message before forwarding it. The marking actions that the network device can perform on the data message may include, for example, re-marking the DSCP of the data message, or modifying the priority of the data message.

[0228] The network device obtains the processing strategy in the following ways:

[0229] Method 1: The network device 101 receives a processing strategy instruction, which may be an instruction manually configured to the network device by a network management system, a network application, or an operation and maintenance personnel. The network device 101 saves the processing strategy according to the processing strategy instruction, and the processing strategy includes a first micro-segment identifier.

[0230] Method 2: The network device may also obtain the processing strategy by presetting the processing strategy during production instead of receiving the processing strategy instruction.

[0231] In one example, the processing strategy obtained by the network device 101 is as shown in Table 5. The network device 101 uses the first micro-segment segment identifier as a matching condition. When the first micro-segment segment identifier corresponding to the data packet received by the network device 101 is End.XTEpg SID3, the "mark" processing action is executed. When the first micro-segment segment identifier corresponding to the data packet received by the network device is End.XTEpg SID4, the "discard" processing action is executed. The processing actions shown in Table 5 are only examples. The content corresponding to the processing action can be a processing action identifier, so that the network device can further obtain the corresponding specific processing action according to the processing action identifier. The content corresponding to the processing action can also be a specific processing action, such as: remark dscp 40, indicating that the DSCP of the data packet that meets the conditions is changed to 40. In an example, the first micro-segment segment identifier can also be recorded as the destination micro-segment segment identifier.

[0232] Table 5

[0233] Micro-segment segment identification Processing Actions End.XTEpg SID3 mark End.XTEpg SID4 throw away

[0234] In one example, the processing strategy obtained by the network device 101 is shown in Table 6. The network device 101 obtains the corresponding micro-segment according to the first micro-segment segment identifier, such as: obtaining the micro-segment from the 64th to 80th bits of the micro-segment segment identifier, and using the micro-segment as a matching condition. When the first micro-segment segment identifier corresponding to the data packet received by the network device 101 is End.XTEpg SID3, the first micro-segment is obtained as EPG3 according to the micro-segment segment identifier, and the "marking" processing action is executed. When the first micro-segment segment identifier corresponding to the data packet received by the network device is End.XTEpg SID4, the first micro-segment is obtained as EPG4 according to the micro-segment segment identifier, and the "discarding" processing action is executed. The first micro-segment can also be recorded as a destination micro-segment or a destination endpoint group.

[0235] Table 6

[0236]

[0237] Optionally, the network device 101 also determines a processing strategy for the first data message based on the second micro-segment segment identifier. The second micro-segment segment identifier indicates a micro-segment of the network device 101. Before the network device 101 determines a processing strategy for the first data message based on the second micro-segment segment identifier, the network device 101 needs to obtain the second micro-segment segment identifier first. Regarding how the network device 101 obtains the second micro-segment segment identifier, similar to the way the above-mentioned network device 103 obtains the micro-segment segment identifier, in some possible embodiments, the second micro-segment segment identifier can be automatically assigned by the network device 101, or the second micro-segment segment identifier can be manually configured. For specific methods of obtaining, refer to the above-mentioned method 1 and method 2 for the network device 103 to obtain the micro-segment segment identifier, which will not be repeated here.

[0238] In one example, applied to Figure 1 In the scenario shown, the correspondence between the micro-segment identifiers obtained by the network device 101 and the micro-segments can be shown in Table 7 below.

[0239] Table 7

[0240]

[0241]

[0242] When the network device 101 has a correspondence between the micro-segment segment identifier and the micro-segment as shown in Table 1, there is also a correspondence between the micro-segment and the endpoint group, and the endpoint group can be defined by the IP address of the endpoint device, the interface connecting the endpoint group device and the network device 101, the MAC address, and other information. The following example uses the IP address of the endpoint device to represent the endpoint group: For example, VM1 and VM2 can be represented by the same IP address prefix A1::1:1 / 80, and VM3 and VM4 can be represented by the same IP address prefix A1::1:2 / 80 as shown in Table 7 below.

[0243] Table 8

[0244] Micro-segmentation identification Endpoint Groups EPG1 A1::1:1 / 80 EPG2 A1::1:2 / 80

[0245] In another example, applied to Figure 1 In the scenario shown, the correspondence between the micro-segment identifier obtained by the network device 101 and the endpoint group can be as shown in Table 9 below. In this example, the endpoint group is defined by the interface connecting the endpoint group device to the network device 101, which can be a virtual sub-interface or a physical interface. The following takes the virtual sub-interface as an example: End.XTEpg SID1 corresponds to the endpoint group EPG1, and the interface connecting the network device 101 to the endpoint group EPG1 is its virtual interface 1, and its name is vInf101-1; End.XTEpg SID2 corresponds to the endpoint group EPG2, and the port connecting the network device 101 to the endpoint group EPG2 is its virtual interface 2, and its name is vInf101-2.

[0246] Table 9

[0247] Micro-segment segment identification Endpoint Groups End.XTEpg SID1 vInf101-1 End.XTEpg SID2 vInf101-2

[0248] When the correspondence between the micro-segment identifier and the endpoint group is as shown in Table 9, the micro-segment identifier can also be used as an identifier of a micro-segment to indicate a micro-segment.

[0249] It should be understood that the above are only examples of the correspondence between micro-segmentation segment identifiers and micro-segments or endpoint groups. In the specific implementation process, the correspondence between micro-segmentation segment identifiers and micro-segments or endpoint groups can be obtained based on the above multiple methods, such as based on IP prefixes, or a specific combination of IP addresses, or the interface connected to the endpoint and the network device, etc.

[0250] After the network device 101 receives the first data packet, it determines the second micro-segment segment identifier according to the received first data packet. Corresponding to the correspondence information between the micro-segment segment identifier and the endpoint group on the network device 101, the network device 101 determines the second micro-segment segment identifier according to "receiving the first data packet" including one or more of the following methods:

[0251] Method 1: The network device 101 determines the second micro-segment identifier according to the source IP address of the first data packet. For example, when the first data packet is the first data packet sent by VM1, and its source IP address is A1::1:1, the network device 101 confirms that VM1 belongs to the endpoint group EPG1 according to the endpoint group information in the corresponding relationship shown in Table 7, and further determines the micro-segment identifier corresponding to the endpoint group as End.XTEpg SID1 according to the corresponding relationship shown in Table 6.

[0252] Method 2: The network device 101 determines the second micro-segment identifier according to the interface receiving the first data message. For example, when the network device 101 receives the first data message from vInf101-1, as shown in Table 9, the network device 101 determines that the second micro-segment identifier corresponding to the first data message is End.XTEpg SID1.

[0253] Before the network device 101 determines the processing strategy for the first data message according to the second micro-segment segment identifier, the network device 101 also obtains the processing strategy including the second micro-segment segment identifier. The way in which the network device 101 obtains the processing strategy including the second micro-segment segment identifier is the same as the way in which the network device 101 obtains the processing strategy including the first micro-segment segment identifier, which will not be repeated here.

[0254] In one example, the processing strategy obtained by the network device 101 is shown in Table 10, and the matching conditions of the processing strategy include the second micro-segment segment identifier and the first micro-segment segment identifier, which can also be recorded as: the source micro-segment segment identifier and the destination micro-segment segment identifier. Table 10 shows two processing strategies. The first processing strategy indicates that when the second micro-segment segment identifier and the first micro-segment segment identifier determined by the data message received by the network device 101 meet the matching conditions: the second micro-segment segment identifier is End.XTEpg SID1 and the first micro-segment segment identifier is End.XTEpg SID3, the network device 101 performs a processing action on the data message: marking. The second processing strategy indicates that when the second micro-segment segment identifier and the first micro-segment segment identifier determined by the data message received by the network device 101 meet the matching conditions: the second micro-segment segment identifier is End.XTEpg SID1 and the first micro-segment segment identifier is End.XTEpg SID2, the network device 101 performs a processing action on the data message: discard.

[0255] Table 10

[0256] Second micro segment identifier First micro segment identifier Processing Actions End.XTEpg SID1 End.XTEpg SID3 mark End.XTEpg SID1 End.XTEpg SID4 throw away

[0257] In one example, the processing strategy obtained by the network device 101 is shown in Table 11. The matching conditions of the processing strategy include the second micro-segment and the first micro-segment, which can also be recorded as: source micro-segment and destination micro-segment, or recorded as: source endpoint group and destination endpoint group. Table 11 shows two processing strategies. The first processing strategy indicates that when the second micro-segment and the first micro-segment meet the matching conditions: the second micro-segment is EPG1 and the first micro-segment is EPG3, the network device 101 performs a processing action on the data packet: marking. The second processing strategy indicates that when the second micro-segment and the first micro-segment determined by the data packet received by the network device 101 meet the matching conditions: the second micro-segment is EPG1 and the first micro-segment is EPG4, the network device 101 performs a processing action on the data packet: discard.

[0258] When the second micro-segment segment identifier determined by the data message received by the network device 101 is End.XTEpg SID1, the second micro-segment determined by the network device 101 according to the second micro-segment segment identifier is EPG1, and when the first micro-segment segment identifier determined by the data message received by the network device 101 is End.XTEpg SID3, the first micro-segment determined by the network device 101 according to the first micro-segment segment identifier is EPG3. Then the processing action determined by the network device 101 according to the second micro-segment and the first micro-segment is marking.

[0259] Table 11

[0260] Second micro segment First micro segment Processing Actions EPG1 EPG3 mark EPG1 EPG4 throw away

[0261] When the network device 101 determines the processing action for the data message according to the processing strategy, the network device 101 can perform strict matching or longest matching on the data message and the matching condition. Strict matching indicates that the processing action to be performed on the data message is determined only when the data message completely satisfies the matching condition. Longest matching indicates that the processing action for the data message is determined according to the matching condition of the longest match of the data message. When there are multiple processing strategies with equal matching lengths, the first hit, the last hit, or the highest priority hit processing strategy can be executed.

[0262] The method for calculating the matching length by the network device 101 may include multiple methods. For example, in method 1, one branch that satisfies the matching condition may be regarded as one length. For example, if the matching condition shown in Table 10 above contains two branches, namely, matching the second micro-segment segment identifier and matching the first micro-segment segment identifier, the longest matching length is 2. In method 2, matching is performed according to the conditions of first matching the first micro-segment segment identifier, then matching the second micro-segment segment identifier, and then matching other branches. For each matching item, the matching length is increased by 1.

[0263] The following are examples of strict matching and longest matching respectively: For example, when the processing strategy obtained in the network device 101 is as shown in Table 10, when strict matching is adopted, the processing action for the data message is determined only when the second micro-segment segment identifier and the first micro-segment segment identifier determined by the network device 101 according to the received data message are (End.XTEpg SID1, End.XTEpg SID3) or (End.XTEpgSID1, End.XTEpg SID4), that is, the matching condition of the first processing strategy is fully met or the matching condition of the second processing strategy is fully met. If only the first micro-segment segment identifier is matched as End.XTEpg SID3, the network device 101 believes that there is no processing action for the data message, and the network device 101 executes the default processing action, such as forwarding or discarding. The default processing action can be a default processing policy configured on the network device, or it can be the default processing policy of all devices in the segment routing network. When the longest match is adopted, when the network device 101 determines that the second micro-segment identifier is End.XTEpg SID1 and the first micro-segment identifier is End.XTEpg SID3 according to the received data packet, the processing action for the data packet is confirmed to be marking according to the first processing strategy in Table 9. However, when the network device 101 only determines that the first micro-segment identifier is End.XTEpg SID3 according to the received data packet, but does not obtain the second micro-segment identifier, or the obtained second micro-segment identifier is not End.XTEpg SID1, the network device 101 can still determine that the first processing strategy matches the data packet, thereby determining that the processing action for the data packet is marking.

[0264] Optionally, the processing strategy obtained by the network device also includes the sending direction of the data message. If the sending direction of the data message is inflow (in), it indicates that the processing strategy is a processing strategy for the data message received by the network device; if the sending direction of the data message is outflow (out), it indicates that the processing strategy is a processing strategy for the data message sent by the network device.

[0265] In one possible manner, after the network device 101 also determines the second micro-segment segment identifier based on the received data message, the network device 101 can determine the processing action for the first data message based only on the second micro-segment segment identifier. The method and optional manner for the network device 101 to determine the processing action for the first data message based on the second micro-segment segment identifier are the same as the method and optional manner for the network device 101 to determine the processing action for the first data message based only on the first micro-segment segment identifier, and are not repeated here.

[0266] S308: The network device 101 performs a determined processing action on the first data packet.

[0267] In S307, when the network device 101 does not search for or execute the processing strategy according to the configuration and determines that the processing action for the first data message is forwarding, S309 is executed.

[0268] In S307, when the network device 101 searches for the processing strategy of the first data message according to the configuration and processes the first data message according to the processing strategy, one of the following steps is performed according to the determined processing action:

[0269] When the processing action determined by the network device 101 for the first data message is to discard, the network device 101 discards the first data message and ends the process.

[0270] When the network device 101 determines that the processing action for the first data message is mirroring, the network device 101 mirrors the first data message to the specified address, and the process ends.

[0271] When the processing action for the first data message determined by the network device 101 is redirection, the network device 101 changes the forwarding destination address of the first data message and ends the process.

[0272] When the processing action determined by the network device 101 is forwarding or marking, S309 is executed.

[0273] S309: The network device 101 generates a second data packet according to the first data packet.

[0274] The network device 101 generates a second data packet according to the obtained segment routing network forwarding path for the first data packet and the first data packet. The network device 101 may obtain the segment routing network forwarding path in the following manners: 1. The network device 101 itself has the ability to calculate the segment routing network forwarding path, and the network device 101 determines the segment routing network forwarding path. 2. The network device 101 obtains the segment routing network forwarding path from a controller or a path calculation unit.

[0275] In one example, when the intermediate network device does not support SR, the segment routing network forwarding path for the data message from VM1 to VM5 obtained by the network device 101 is: End.XTEpg SID3. When the intermediate network device supports SR, the segment routing network forwarding path for the data message from VM1 to VM5 obtained by the network device 101 may correspond to a segment identifier list, and the segment identifier list may include one or more segment identifiers, such as the segment identifier list is: End.SID102, End.XTEpg SID3, wherein End.SID102 is the segment identifier of the network device 102, and End.XTEpg SID3 is a micro-segment segment identifier of the network device 101.

[0276] The network device 101 generates a second data packet according to the forwarding path and the first data packet. SRv6 is used as an example below, and the SR-MPLS solution is similar to this, which will not be described in detail here.

[0277] The network device 101 generates a second data message, where the second data message includes an SRH, where the SRH includes a segment identifier list, where the segment identifier list includes a first micro-segment segment identifier, such as End.XTEpg SID3.

[0278] Optionally, the segment identifier list also includes the segment identifiers of intermediate network devices, such as the segment identifier of network device 102 .

[0279] Optionally, the second data message also includes a second micro-segment identifier. The embodiment of the present application provides multiple ways of carrying the second micro-segment identifier in the data message, including:

[0280] Method 1: The segment identifier list also includes the second micro-segment segment identifier, such as the source micro-segment segment identifier in the example, End.XTEpg SID1.

[0281] In a Figure 7 In the example of SRH shown, when the second endpoint group end identifier is carried in the SRH, the second micro-segment segment identifier is carried at the position of Segment List[0] of the SRH, and the first micro-segment segment identifier is carried at the position of Segment List[1] of the SRH, that is, the value of the remaining nodes (segments left) in the SRH is at least 1.

[0282] Method 2: The second data message also includes metadata, and the metadata carries the second micro-segment segment identifier. In order to allow the second data message to carry the second micro-segment segment identifier, a new metadata can be defined. In this method, the first micro-segment segment identifier can also be carried in the metadata, so that all network devices in the segment routing network that need to process data messages according to the micro-segment segment identifier can obtain the first micro-segment segment identifier and the second micro-segment segment identifier only through the metadata, without having to obtain the first micro-segment segment identifier and the second micro-segment segment identifier from the SRH of the data message.

[0283] This metadata can be obtained by Figure 8The TLV shown is carried. In the TLV, the type field indicates that it is metadata carrying a micro-segment segment identifier, and the value of the type field can be a specific value applied for by the endpoint group end identifier, such as 91. The length field indicates the overall length of the metadata, and the reserved field can be reserved for special processing and currently has no specific definition. The second micro-segment segment identifier field carries the second micro-segment segment identifier, such as: End.XTEpg SID2. Optionally, the TLV also includes a first micro-segment segment identifier field, and the first micro-segment segment identifier field carries the first micro-segment segment identifier, such as: End.XTEgp SID1.

[0284] Method three: the network device 101 copies the IPv6 header of the first data packet and carries it in the payload of the second data packet, and generates a new IPv6 header for the second data packet, where the source address in the IPv6 header is the second micro-segment identifier.

[0285] The operation and maintenance personnel can configure in advance on the network device whether the second micro-segment segment identifier needs to be carried when generating the second data message, and which of the above three methods is used to carry the second micro-segment segment identifier. Or the network device uses a consistent method to carry the second micro-segment segment identifier by default.

[0286] After the operation and maintenance personnel configure the network device to carry the second micro-segment segment identifier when generating the second data packet and determine the method for the network device 101 to carry the second micro-segment segment identifier, in order to ensure that the second data packet generated by the network device 101 can be correctly processed during the forwarding process without affecting the forwarding of the data packet, when the network device 101 generates the SRH of the second data packet, it can identify the carrying method of the second micro-segment segment identifier in the SRH, so that the network device in the segment routing network that can process the data packet according to the micro-segment segment identifier can determine the location of obtaining the second endpoint group end identifier during the message forwarding process.

[0287] like Fig. 9As shown in the schematic diagram of the Flag bits of the SRH of the second data message shown, the flag bits (Flags) of the SRH occupy 8 bits, of which U is not currently used, and the P flag occupies 1 bit and is a protection flag. The O flag occupies 1 bit and is an operation, administration and maintenance (OAM) flag. The A flag occupies 1 bit and is an alarm flag. If it exists, it means that an important TLV exists. The H flag occupies 1 bit and is a hash-based message authentication code (HMAC) flag. If it exists, it means that an HMAC TLV exists. The network device 101 can identify the location where the second endpoint group is carried in the low bit of the U flag in the Flags field of the SRH. For example, when the 8th bit of Flags is 1, it indicates that the second micro-segment segment identifier is carried in the above-mentioned method one, and is carried in segment[0] of the segment identifier list of the SRH. When the 7th bit of the Flags field is 1, it indicates that the second micro-segment identifier is carried in the metadata of the SRH using the second method mentioned above. When the 6th bit of the Flags field is 1, it indicates that the second micro-segment identifier is carried in the source IP address of the IPv6 header of the second message using the third method mentioned above.

[0288] S311 : The network device 101 sends a second data packet to the network device 103 .

[0289] The network device 101 sends a second data packet to the network device 103 according to the routing forwarding information. The second data packet carries the first micro-segment identifier.

[0290] Optionally, the second data message also carries a second micro-segment identifier.

[0291] S321: After receiving the second data message sent by the network device 101, the network device 103 obtains the first micro-segment identifier from the second data message.

[0292] For example, the network device 103 obtains the first micro-segment identifier from the second data message as: End.XTEpgSID3.

[0293] Before the network device 103 determines the processing action for the data packet according to the first micro-segment identifier, the network device 103 also needs to obtain a processing strategy, which includes matching conditions and processing actions. The processing actions in the processing strategy include one or more of the following: forwarding, discarding, marking, redirecting, and mirroring. Among them, marking is a special forwarding, that is, the network device marks the data packet before forwarding it. The marking actions that the network device can perform on the data packet may include, such as re-marking the DSCP of the data packet, or modifying the priority of the data packet.

[0294] The way in which network device 103 obtains the processing strategy and the content of the processing strategy are consistent with the way in which network device 101 obtains the processing strategy and the content of the processing strategy. For details, please refer to the detailed description of where network device 101 obtains the processing strategy. This application will not repeat them here.

[0295] S323: The network device 103 determines a processing action for the second data message according to the first micro-segment identifier.

[0296] The way in which network device 103 determines the processing action for the second data packet based on the first micro-segment segment identifier is consistent with the way in which network device 101 determines the processing action for the first data packet based on the first micro-segment segment identifier. For details, please refer to the detailed description of the network device 101 determining the processing action for the first data packet based on the first micro-segment segment identifier. This application will not repeat it here.

[0297] Optionally, the network device 103 further determines a processing action for the second data packet according to the second micro-segment identifier.

[0298] When the second data message also carries the second micro-segment segment identifier, the network device 103 also obtains the second micro-segment segment identifier, and performs a processing action on the second data message according to the first micro-segment segment identifier and the second micro-segment segment identifier.

[0299] Corresponding to the three ways in which the network device 101 carries the second micro-segment segment identifier, and the identifier of the carrying method in the second data message: the network device 103 obtains the second micro-segment segment identifier from the corresponding position of the second data message according to the indication of the identifier. For example, when the 8th bit of the Flags field of the SRH of the second data message is 1, the network device 103 obtains the second micro-segment segment identifier from segment[0] of the segment identifier list of the SRH of the second data message. When the 7th bit of the Flags field is 1, the network device 103 obtains the second micro-segment segment identifier from the metadata of the SRH of the second data message. When the 6th bit of the Flags field is 1, the network device 103 obtains the second micro-segment segment identifier from the source IP address of the IPv6 header of the second data message.

[0300] In a possible implementation, the network device directly obtains the second micro-segment identifier according to a default rule, for example, from metadata.

[0301] The way in which the network device 103 determines the processing action for the second data packet based on the first micro-segment segment identifier and the second micro-segment segment identifier is consistent with the way in which the network device 101 determines the processing action for the first data packet based on the first micro-segment segment identifier and the second micro-segment segment identifier. For details, please refer to the detailed description of the network device 101 determining the processing action for the first data packet based on the first micro-segment segment identifier and the second micro-segment segment identifier. This application will not repeat them here.

[0302] In one possible manner, when the second data message received by the network device 103 also carries the second micro-segment segment identifier, the network device 103 can determine the processing action for the second data message based only on the second micro-segment segment identifier. The method and optional manner for the network device 103 to determine the processing action for the second data message based on the second micro-segment segment identifier are the same as the method and optional manner for the network device 101 to determine the processing of the first data message based only on the first micro-segment segment identifier, and are not repeated here.

[0303] S325: The network device 103 performs a determined processing action on the second data packet.

[0304] When the processing action determined by the network device 103 for the second data packet is to discard, the network device 103 discards the second data packet.

[0305] When the network device 103 determines that the processing action for the second data message is mirroring, the network device 103 mirrors the first data message to the designated address.

[0306] When the processing action determined by the network device 103 for the second data message is redirection, the network device 103 changes the forwarding destination address of the first data message.

[0307] S327: When the processing action determined by the network device 103 is forwarding or marking, the network device 103 generates a third data packet according to the second data packet.

[0308] Corresponding to the three ways in which the network device 101 carries the second micro-segment identifier, and the identifier of the carrying method in the second data message: the network device 103 generates a third data message according to the second data message according to the indication of the identifier. When the 8th bit of the Flags field of the SRH of the second data message is 1, when the network device generates the third message according to the second message, it strips the SRH of the second data message to generate the third data message. When the 7th bit of the Flags field is 1, the network device 103 strips the SRH and metadata of the second data message to generate the third data message. When the 6th bit of the Flags field is 1, the network device 103 replaces the IPv6 message header of the second data message with a copied IPv6 message header (that is, the IPv6 message header of the first message), and strips the SRH of the second data message to generate the third data message, and the IPv6 message header of the third data message is the IPv6 message header of the first message.

[0309] Or the network device follows a default rule, such as stripping the SRH of the second data message, to obtain the third data message.

[0310] S329: The network device 103 sends a third data message.

[0311] The network device sends the third data packet to the endpoint VM5 in the corresponding endpoint group according to the micro-segment EPG3 identified by the first micro-segment identifier. For example, the network device 103 sends the third data packet to the destination IP address of the third data packet (ie, the IP address of VM5).

[0312] The above is a method embodiment provided by an embodiment of the present application. The method embodiment provides a method for processing data packets according to micro-segment segment identifiers, which acts on a head node and a tail node in a segment routing network.

[0313] like Figure 3b The method embodiment shown in the figure provides a flow chart of a method for processing a data message, which is similar to Figure 3a The main difference between the method embodiments shown is that the first network device and the second network device process the message according to the first micro-segment segment identifier and the second micro-segment segment identifier. Figure 3a A detailed representation of the method embodiment. The specific content of each execution step can be specifically referred to Figure 3a The same numbered steps in the above and their optional implementations are not repeated here for the sake of brevity. Figure 3b Detailed steps of the embodiment.

[0314] Another method embodiment is introduced below. This method embodiment provides a method for processing data packets according to micro-segment segment identifiers, which acts on the head node, intermediate node, and tail node in the segment routing network. In the embodiment of the present application, the method for processing data packets according to the micro-segment segment identifiers performed by the head node and the tail node is similar to the method in the previous method embodiment. The embodiment of the present application will focus on the differences from the previous method embodiment for detailed explanation.

[0315] The following, combined Figure 1 and Figure 4a The steps and optional methods mainly included in the method are explained. For ease of understanding, the network device 101 is used as the third network device, the network device 102 is used as the second network device, and the network device 103 is used as the first network device as an example to explain the embodiment of the method. It should be understood that this is only an example, and those skilled in the art can also refer to this embodiment to make similar replacements and applications, and this application will not cite examples one by one.

[0316] S401: The network device 103 publishes a first micro-segment identifier.

[0317] Method and optional manner for network device 103 to issue first micro-segment segment identifier, and method and optional manner for network device 103 to obtain first micro-segment segment identifier, and Figure 3a The method and optional manner in the embodiment shown are consistent, please see Figure 3a The contents and optional methods related to step S301 in the embodiment are not described in detail here.

[0318] S402: The network device 102 publishes a micro-segmentation node segment identifier.

[0319] Since the network device 102 is the first data packet Figure 1 For the intermediate forwarding nodes on the forwarding path in the segment routing network shown, in order to enable the network device 102 to also have the function of performing processing actions on data packets according to the micro-segment segment identifier, a method of defining and publishing segment identifiers with specific functions for the network device 102 can be adopted. The segment identifier with specific functions is the micro-segment node segment identifier, so that the network device 102 has this function.

[0320] The micro-segment node segment identifier corresponds to a network device and can be expressed as End.TEpg SID, where End stands for endpoint, T stands for table lookup, Epg stands for endpoint group, and SID stands for segment identifier. The endpoint group segment node identifier can meet the format of IPv6 address or MPLS label.

[0321] The network device 102 may publish micro-segment node segment identifiers in three or more of the following ways:

[0322] Method 1: The network device 102 sends a notification message, which carries the micro-segment node segment identifier.

[0323] The notification message may be a Border Gateway Protocol (Border Gateway Protocol, BGP) message or an Interior Gateway Protocol (Interior Gateway Protocol, IGP) message, which is not specifically limited in this application.

[0324] Optionally, the micro-segment node segment identifier in the notification message is carried in its second type length value (typelength value, TLV). The format of the second TLV is shown as follows: Fig.10 As shown. The type field identifier in the figure indicates the type of the second TLV. The value of the type field can identify that the second TLV is a TLV used to publish End.TEpg SID. The value of the type field can be the type of new application for publishing micro-segment node segment identifier, for example, it can be 92. The value of the length field identifies the length of the second TLV. The flag field value can be 0 or 1. For example, when the value is 0, it indicates that it is a TLV of endpoint group type. The reserved field is reserved for subsequent extensions, such as for identifying forwarding paths. The micro-segment node segment identifier field is used to carry the micro-segment node segment identifier.

[0325] Method 2: The network device 102 may publish micro-segment node segment identifiers through the BGP link state protocol (Border Gateway Protocol-link state, BGP-LS).

[0326] Specifically, the network device 102 may send the micro-segment node segment identifier to the controller via BGP-LS. The controller may receive the micro-segment node segment identifier sent by the network device 102 via BGP-LS and send the micro-segment segment identifier to the network device 101 .

[0327] Method three: the network device 102 may publish micro-segment node segment identifiers through the Path Computation Element Communication Protocol (PCEP).

[0328] Specifically, the network device 102 can send the micro-segment node segment identifier to the controller or path computation element (PCE) through PCEP. The controller can receive the micro-segment node segment identifier sent by the network device 102 through PCEP and send the micro-segment node segment identifier to the network device 101.

[0329] In a possible design, before the network device 102 publishes the micro-segment node segment identifier, the network device 102 needs to obtain the micro-segment node segment identifier first. Regarding how the network device 102 obtains the micro-segment node segment identifier, in some possible embodiments, the network device 102 may automatically allocate the micro-segment node segment identifier, or manually configure at least the micro-segment node segment identifier. Specifically, the method of obtaining the micro-segment node segment identifier may include any one or more of the following methods 1 or 2.

[0330] Method 1: The network device 102 allocates a micro-segment node segment identifier to itself.

[0331] In one example, the network device 102 can allocate one or more micro-segmentation node segment identifiers to itself. For example, the segment identifier can be a segment identifier representing a node type or a segment identifier representing adjacency. The network device 102 can store a segment identifier space and can select an unoccupied micro-segmentation node segment identifier from the segment identifier space and allocate the micro-segmentation node segment identifier to itself.

[0332] Method 2: The network device 102 receives the configuration instruction, and the network device 102 obtains the micro-segment node segment identifier from the configuration instruction. The network device 102 can also obtain the correspondence between the micro-segment node segment identifier and the forwarding path from the configuration instruction. The configuration instruction can be triggered by the user's configuration operation on the network device 102, and the configuration instruction may also be triggered by a network management or controller.

[0333] In an SRv6 example, the specific value of the micro-segment node segment identifier includes the following two parts: location information (Locator) and function (Function): SRv6 SID is in the form of an IPv6 address. SRv6 SID can be composed of two parts: location information and function, and the format is: location information: function. Among them, the location information occupies the high bits of the IPv6 address, and the function occupies the low bits of the IPv6 address. Among them, the location information can have a positioning function and can be unique in the SR domain. The function represents the instructions of the device. These instructions are pre-set by the device. The function part is used to instruct the SRv6 SID generation device to perform corresponding functional operations. In an example, the micro-segment node segment identifier obtained by the network device 102 includes a location and a function part. The function part is used to instruct the network device 102 to perform predefined operations on the data message according to the micro-segment segment identifier.

[0334] Optional: Network device 101 and network device 103 also publish micro-segment node segment identifiers. The way in which network device 101 and network device 103 obtain and publish micro-segment node segment identifiers is consistent with that of network device 102, and will not be repeated here.

[0335] S403: The network device 101 obtains a first micro-segment identifier.

[0336] Method and optional manner for network device 101 to obtain first endpoint group Figure 3a The method and optional manner in the embodiment shown are consistent, please see Figure 3a The contents and optional methods related to step S303 in the embodiment are not described in detail here.

[0337] S404: The network device 101 obtains a micro-segment node segment identifier.

[0338] Corresponding to the manner in which the network device 102 publishes the micro-segment node segment identifier, the manner in which the network device 101 obtains the micro-segment node segment identifier may be the following two manners.

[0339] Method 1: The network device 101 receives a notification message sent by the network device 102, and the message carries the micro-segment node segment identifier.

[0340] Specifically, when network device 102 sends a micro-segment node segment identifier via a BGP message, network device 101 receives a BGP message sent by network device 103 and obtains the micro-segment node segment identifier from the message; when network device 102 sends a micro-segment node segment identifier via an IGP message, network device 101 receives an IGP message sent by network device 102 and obtains the micro-segment node segment identifier from the message.

[0341] Specifically, when the micro-segment node segment identifier is carried in the second TLV of the BGP message or the IGP message, the network device 101 obtains the micro-segment node segment identifier from the second TLV of the BGP message or the IGP message.

[0342] Method 2: The network device 101 receives a micro-segment node segment identifier sent from a controller or a path calculation unit.

[0343] Specifically, when the network device 102 sends a micro-segment node segment identifier to the controller through BGP-LS, the controller can receive the micro-segment node segment identifier sent by the network device 102 through the BGP-LS protocol, and send the micro-segment node segment identifier to the network device 101. When the network device 102 sends a micro-segment node segment identifier to the controller or PCE by sending a PCEP message, the controller or PCE can receive the micro-segment node segment identifier sent by the network device 102, and send the micro-segment node segment identifier to the network device 101. The time when the controller or PCE executes to send the micro-segment node segment identifier to the network device 101 can be immediately after receiving the micro-segment node segment identifier, or it can be sent to the network device 101 after a period of time, or when the network device 101 requests a forwarding path from the controller or PCE.

[0344] There is no order in which steps S401 and S402 are executed, and there is no order in which steps S403 and S404 are executed.

[0345] S405: The network device 101 receives a first data packet, and determines a first micro-segment identifier according to the first data packet, where the first data packet does not include the first micro-segment identifier.

[0346] The method and optional manner for the network device 101 to determine the first micro-segment identifier according to the first data message are the same as Figure 3a The method and optional manner in the embodiment shown are consistent, please see Figure 3a The contents and optional methods related to step S305 in the embodiment are not described in detail here.

[0347] S407: The network device 101 determines a processing action for the first data message according to the first micro-segment identifier.

[0348] Method and optional manner for the network device 101 to determine a processing action for a first data message according to a first micro-segment identifier Figure 3a The method and optional manner in the embodiment shown are consistent, please see Figure 3a The contents and optional methods related to step S307 in the embodiment are not described in detail here.

[0349] S408: The network device 101 performs a determined processing action on the first data packet.

[0350] Method and optional manner for the network device 101 to perform a determined processing action on the first data message according to the first micro-segment segment identifier Figure 3a The method and optional manner in the embodiment shown are consistent, please see Figure 3a The contents and optional methods related to step S308 in the embodiment are not described in detail here.

[0351] S409: When the processing action determined by the network device 101 according to the first data packet includes forwarding or marking, the network device 101 generates a second data packet according to the first data packet.

[0352] The network device 101 generates a second data packet according to the obtained segment routing network forwarding path for the first data packet and the first data packet. The network device 101 may obtain the segment routing network forwarding path in the following manners: 1. The network device 101 itself has the ability to calculate the segment routing network forwarding path, and the network device 101 determines the segment routing network forwarding path. 2. The network device 101 obtains the segment routing network forwarding path from a controller or a path calculation unit.

[0353] In an example, the segment identifier list corresponding to the forwarding path obtained by the network device 101 is: End.TEpgSID1021, End.XTEpg SID3.

[0354] The network device 101 generates a second data packet according to the forwarding path and the first data packet. SRv6 is used as an example below, and the SR-MPLS solution is similar to this, which will not be described in detail here.

[0355] The network device 101 generates a second data packet, which includes an SRH, and the SRH includes a segment identifier list, which includes a first micro-segment segment identifier and a micro-segment node segment identifier, such as End.TEpg SID1021, End.XTEpg SID3. When the segment identifier list does not include the second micro-segment segment identifier, the first micro-segment segment identifier is carried at the Segment List[0] position of the SRH, and the micro-segment node segment identifier is carried at the Segment List[n] position of the SRH, where n>0, and n is the number of intermediate nodes on the specified path.

[0356] Optionally, the second data message also includes a second micro-segment segment identifier. When the segment identifier list includes the second micro-segment segment identifier, the first micro-segment segment identifier is carried in the Segment List[1] position of the SRH, the second micro-segment segment identifier is carried in the Segment List[0] position of the SRH, and the micro-segment node segment identifier is carried in the SegmentList[n+1] position of the SRH, where n>1. The method and optional manner for the network device 101 described in the present method embodiment to generate the second data message carrying the second micro-segment segment identifier is the same as Figure 3a The method and optional method of carrying the second micro-segment identifier in the second message in the embodiment shown are consistent. For details, see Figure 3a The relevant contents of S309 in the illustrated embodiment will not be repeated in this application.

[0357] S411: Network device 101 sends a second data packet to network device 102.

[0358] The network device 101 sends a second data packet to the network device 102 according to the routing forwarding information. The second data packet carries the first micro-segment segment identifier and the micro-segment node segment identifier.

[0359] Optionally, the second data message also carries a second micro-segment identifier.

[0360] S413: After receiving the second data message sent by the network device 101, the network device 102 obtains the first micro-segment identifier from the second data message.

[0361] Network device 102 receives the second data message sent by network device 101, and the destination address in the SRH of the data message is the micro-segment node segment identifier issued by network device 102, such as End.TEpg SID1021. Network device 102 performs the function indicated by the micro-segment node segment identifier, that is, performs processing actions on the data message according to the micro-segment segment identifier.

[0362] The network device 102 obtains the first micro-segment identifier from the second data message, such as End.XTEpg SID3. In this implementation, the network device 102 performs the function indicated by End.TEpg SID1021, that is, performs a processing action on the data message according to End.XTEpg SID3.

[0363] Before the network device 102 determines the processing action for the data packet according to the first micro-segment identifier, the network device 102 also needs to obtain a processing strategy, which includes matching conditions and processing actions. The processing actions in the processing strategy include one or more of the following: forwarding, discarding, marking, redirecting, and mirroring. Among them, marking is a special forwarding, that is, the network device marks the data packet before forwarding it. The marking actions that the network device can perform on the data packet may include, such as re-marking the DSCP of the data packet, or modifying the priority of the data packet.

[0364] The method of obtaining the processing strategy by the network device 102 and the content of the processing strategy Figure 3a The way in which the network device 101 obtains the processing policy in the method embodiment shown is consistent with the content of the processing policy. For details, see Figure 3a The detailed description of the step S307 where the network device 101 obtains the processing strategy is shown, and this application will not repeat it here.

[0365] S415: The network device 102 determines a processing action for the second data message according to the first micro-segment identifier.

[0366] The network device 102 determines the processing mode of the second data message according to the first micro-segment segment identifier. Figure 3a The network device 103 in the method embodiment shown in the figure determines the processing action for the first data message according to the first micro-segment identifier in a consistent manner. For details, see Figure 3a The network device 103 in the illustrated method embodiment determines a detailed description of the processing action for the first data message according to the first micro-segment identifier (such as step 323), which will not be repeated in this application.

[0367] S416: The network device 102 performs a determined processing action on the second data packet.

[0368] When the network device 102 determines that the processing action for the second data message is to discard, the network device 102 discards the second data message and ends the process.

[0369] When the network device 102 determines that the processing action for the second data message is mirroring, the network device 102 mirrors the first data message to the specified address, and the process ends.

[0370] When the network device 102 determines that the processing action for the second data message is redirection, the network device 102 changes the forwarding destination address of the first data message and ends the process.

[0371] When the processing action determined by the network device 102 is forwarding or marking, S417 is executed.

[0372] S417: The network device 102 generates a third data packet according to the second data packet.

[0373] The network device 102 modifies the second data message to obtain the third data message, including: 1. The network device 102 sets the SL field value of the SRH to the value of SL-1, that is, when SL=1, the SL value is modified to 0, and when SL=2, the SL value is modified to 1. 2. The network device 102 modifies the destination address of the IPv6 header in the second data message to Segmentlist[SL]. In an example, the network device 102 sets the SL field value of the SRH to 0, and modifies the destination address in the IPv6 header to: End.XTEpgSID3.

[0374] S419: The network device 102 sends a third data packet.

[0375] The network device 102 searches the forwarding table entry according to the IPv6 destination address and sends the third data packet.

[0376] In an example, network device 102 sends a third data packet to network device 103 .

[0377] S421: After receiving the third data message sent by the network device 102, the network device 103 obtains the first micro-segment identifier from the third data message.

[0378] Method and optional manner for network device 103 to obtain first micro-segment segment identifier from third data message Figure 3a The method in which the network device 103 obtains the first micro-segment identifier in the method embodiment shown is consistent with the optional method. For details, see Figure 3a The detailed description of S321 in the method embodiment shown is not repeated here in this application.

[0379] S423: The network device 103 determines a processing action for the third data message according to the first micro-segment identifier.

[0380] The method and optional manner for the network device 103 to determine the processing action for the third data message according to the first micro-segment segment identifier Figure 3a The network device 103 in the method embodiment shown in the figure determines the processing action for the second data message according to the first micro-segment identifier in a consistent manner. For details, see Figure 3a The detailed description of S323 in the method embodiment shown is not repeated in this application.

[0381] S425: The network device 103 performs a determined processing action on the third data packet.

[0382] Method and optional manner for the network device 103 to perform a determined processing action on the third data message Figure 3a The network device 103 in the method embodiment shown in the figure performs the determined processing action on the second data message in the same manner. For details, see Figure 3a The detailed description of S325 in the method embodiment shown is not repeated in this application.

[0383] S427: When the processing action determined by the network device 103 is forwarding or marking, the network device 103 generates a fourth data packet according to the third data packet.

[0384] Method and optional manner for network device 103 to generate fourth data message according to third data message Figure 3a The network device 103 in the method embodiment shown in the figure generates the third data message according to the second data message in a consistent manner. For details, see Figure 3a The detailed description of S327 in the method embodiment shown is not repeated here in this application.

[0385] S429: The network device 103 sends a fourth data packet.

[0386] Method and optional manner for network device 103 to send fourth data message Figure 3a The method in which the network device 103 sends the third data message is consistent with that in the method embodiment shown in FIG. Figure 3a The detailed description of S329 in the method embodiment shown is not repeated here in this application.

[0387] like Figure 4b The method embodiment shown in the figure provides a flow chart of a method for processing a data message, which is similar to Figure 4a The main difference of the method embodiment shown is that the first network device, the second network device and the third network device process the message according to the first micro-segment segment identifier and the second micro-segment segment identifier. Figure 4a A detailed representation of the method embodiment. The specific content of each execution step can be specifically referred to Figure 4a The same numbered steps in the above and their optional implementations are not repeated here for the sake of brevity. Figure 4b Detailed steps of the embodiment.

[0388] The above introduces an embodiment of the method for processing data packets provided by the present application. The following introduces the first network device and the second network device provided by the present application.

[0389] Fig.11 is a schematic diagram of a second network device structure provided in an embodiment of the present application. The network device 1100 can execute Figure 3aThe second network device (network device 101) and Figure 4a The method is performed by the second network device (network device 101) shown in FIG. The network device 1100 includes a receiving unit 1101, a processing unit 1102, and a sending unit 1103. The receiving unit 1101 can be used to perform, for example, Figure 3a The related method of receiving the first data message in steps S303 and S305 of the embodiment can also be used to execute, for example, Figure 4a The method for receiving the first data message in steps S403, S404 and S405 in the embodiment. The processing unit 1102 can be used to execute, for example Figure 3a The related method for determining the first micro-segment identifier in steps S307, S308, S309 and S305 in the embodiment can also be used to perform, for example, Figure 4a In the embodiment, steps S407, S408, S409 and S405 in the method for determining the first micro-segment identifier; the sending unit 1103 can be used to perform, for example Figure 3a Step S311 in the embodiment can also be used to perform, for example, Figure 4a Step S411 in the embodiment.

[0390] One thing that needs to be explained is that Fig.11 When the second network device provided in the embodiment processes the data message as described above, only the division of the above-mentioned functional units is used as an example. In practical applications, the above-mentioned functions can be assigned to different functional units as needed, that is, the internal structure of the second network device is divided into different functional units to complete all or part of the functions described above; or the functions of the above-mentioned multiple units can be completed with the same functional unit. It should be understood that the second network device provided in the above-mentioned embodiment and the embodiment of the method for determining the forwarding path are of the same concept. Here, only the steps executed by each unit of the second network device are illustrated, but it does not mean that it does not execute other steps or optional methods in the above-mentioned embodiments. The specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0391] Fig.12 is a schematic diagram of a first network device structure provided in an embodiment of the present application. The network device 1200 can execute Figure 3a The first network device (network device 103) and Figure 4a The method is performed by the first network device (network device 102) and the second network device (network device 103) shown in FIG. The network device 1200 includes a receiving unit 1201, a processing unit 1202, and a sending unit 1203. The receiving unit 1201 can be used to perform, for example, Figure 3aThe processing unit 1202 may be used to perform, for example, Figure 3a In the embodiment shown, the method for obtaining the first micro-segment identifier in steps S323, S325, S337 and S321 is shown. The sending unit 1203 may be used to perform, for example, Figure 3a In the embodiment shown, steps S301 and S319 are performed. The receiving unit 1201 may be used to perform, for example, Figure 4a In the embodiment shown, the method for receiving the second data message in step S413 and the method for receiving the third data message in step S421 are shown. The processing unit 1202 may be used to execute, for example Figure 4a In the embodiment shown, steps S415, S416, S417, S423, S425, S427, the related method of obtaining the first micro-segment segment identifier in S413, and the related method of obtaining the first micro-segment segment identifier in S421. The sending unit 1203 can be used to perform, for example Figure 4a Steps S401, S402, S419 and S429 in the illustrated embodiment.

[0392] One thing that needs to be explained is that Fig.12 When the first network device provided in the embodiment processes the data message as described above, only the division of the above-mentioned functional units is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional units as needed, that is, the internal structure of the first network device is divided into different functional units to complete all or part of the functions described above; or the functions of the above-mentioned multiple units can be completed with the same functional unit. It should be understood that the first network device provided in the above embodiment and the above-mentioned data message processing method embodiment belong to the same concept. Here, only the steps executed by each unit of the first network device are illustrated, but it does not mean that it does not execute other steps or optional methods in the above embodiment. The specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0393] The first network device and the second network device of the embodiment of the present application are introduced above. The possible product forms of the first network device and the second network device are introduced below. It should be understood that any device having the above Fig.11 Any product having the characteristics of the second network device, and any product having the characteristics of the second network device Fig.12 Any product having the characteristics of the first network device in the embodiment of the present application falls within the protection scope of the present application. It should also be understood that the following description is only an example and does not limit the product forms of the first network device and the second network device in the embodiment of the present application.

[0394] Fig.13 It is a structural diagram of a device 1300 provided in an embodiment of the present application. Figure 3aThe first network device or the second network device shown in the embodiment, or Figure 4a The first network device, the second network device or the third network device shown in the embodiment can be Fig.13 See the device shown in Fig.13 The schematic diagram of the device structure shown in FIG. 1300 includes a main control board and one or more interface boards, and the main control board is connected to the interface board in communication. The main control board is also called a main processing unit (MPU) or a route processor card. The main control board is responsible for controlling and managing each component in the device 1300, including routing calculation, device management and maintenance functions. The interface board is also called a line processing unit (LPU) or a line card, which is used to forward data. In some embodiments, the device 1300 may also include a switching fabric board, which is connected to the main control board and the interface board in communication. The switching fabric board is used to forward data between the interface boards. The switching fabric board may also be called a switch fabric unit (SFU). The interface board includes a central processing unit, a memory, a forwarding chip and a physical interface card (PIC). The central processing unit is connected to the memory, the network processor and the physical interface card in communication. The memory is used to store a forwarding table. The forwarding chip is used to forward the received data message based on the forwarding table stored in the memory. If the destination address of the data message is the address of the device 1300, the data message is sent to the central processing unit (CPU), such as the central processing unit 1331 for processing; if the destination address of the data message is not the address of the device 1300, the next hop and the output interface corresponding to the destination address are found from the forwarding table according to the destination address, and the data message is forwarded to the output interface corresponding to the destination address. The forwarding chip can be a network processor (NP). The PIC is also called a daughter card, which can be installed on the interface board and is responsible for converting the photoelectric signal into a data message and forwarding the data message to the forwarding chip for processing after checking the legitimacy of the data message. In some embodiments, the central processing unit can also perform the functions of the forwarding chip, such as realizing software forwarding based on a general-purpose CPU, so that the forwarding chip is not required in the interface board. The communication connection between the main control board, the interface board, and the switching network board can be realized through a bus. In some embodiments, the forwarding chip can be realized by an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0395] Logically, device 1300 includes a control plane and a forwarding plane. The control plane includes a main control board and a central processing unit, and the forwarding plane includes various components that perform forwarding, such as a memory, a PIC, and a NP. The control plane performs functions such as a router, generates a forwarding table, processes signaling and protocol messages, and configures and maintains the status of the device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the NP forwards the message received by the PIC of device 1300 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the memory. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device. The following will combine Figure 3a and Figure 4a The above process is briefly described in detail with reference to the embodiment of the present invention.

[0396] like Figure 3a or Figure 4a As shown in the method described, the second network device in the segmented routing network can receive the first data message through the physical interface card 1333, and when it is determined that the destination IP address of the first data message is the address of the network device 1300, the data message is sent to the CPU 1331 for processing. The CPU 1331 can determine the first micro-segment segment identifier based on the first data message. Optionally, the CPU 1331 is also used to determine the second micro-segment segment identifier based on the first data message. The CPU 1331 is also used to perform corresponding processing actions on the first data message and generate a second data message based on the first micro-segment segment identifier; or perform corresponding processing actions on the first data message and generate a second data message based on the first micro-segment segment identifier and the second micro-segment segment identifier. CPU 1311 can be configured to receive configuration instructions sent by a controller or a computing unit. The physical interface card 1333 can be used to send a second data message to the first network device.

[0397] like Figure 3a or Figure 4a As shown in the method described, the second network device or the first network device in the segmented routing network can receive the first data message through the physical interface card 1333, and when it is determined that the destination IP address of the first data message is the address of the network device 1300, the data message is sent to the CPU 1331 for processing, and the first data message carries a first micro-segment segment identifier, and optionally, the first data message also carries a second micro-segment segment identifier. The CPU 1331 is used to perform corresponding processing actions on the first data message and generate a second data message according to the first micro-segment segment identifier; or to perform corresponding processing actions on the first data message and generate a second data message according to the first micro-segment segment identifier and the second micro-segment segment identifier. CPU 1311 can be configured to receive configuration instructions sent by a controller or a computing unit. The physical interface card 1333 can be used to send a second data message to the first network device.

[0398] The network device provided in the embodiment of the present invention may correspond to the above Figure 3a or Figure 4a The first network device, the second network device or the third network device in the method embodiment can implement the functions and / or various steps and methods implemented by the first network device, the second network device or the third network device in each of the above method embodiments. The above is only a brief exemplary description, and for the sake of brevity, it will not be repeated here.

[0399] It is worth noting that there may be one or more main control boards, and when there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. In a centralized forwarding architecture, network devices may not need switching network boards, and the interface board is responsible for processing the service data of the entire system. In a distributed forwarding architecture, network devices can have at least one switching network board, which realizes data exchange between multiple interface boards and provides large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices with distributed architecture are greater than those of devices with centralized architecture. Optionally, the network device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of device has low data exchange and processing capabilities (for example, low-end switches or routers and other network devices). The specific architecture to be adopted depends on the specific networking deployment scenario, and no limitation is made here.

[0400] Fig.14 It is a structural diagram of a device 1400 provided in an embodiment of the present application. Figure 3a The first network device or the second network device shown in the embodiment, or Figure 4a The first network device, the second network device or the third network device shown in the embodiment can be Fig.14 See the device shown in Fig.14 The device 1400 includes at least one processor 1401 , a communication bus 1402 and at least one communication interface 1404 , and optionally, the device 1400 may also include a memory 1403 .

[0401] The processor 1401 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application. The processor may be used to process the received message to implement the message processing method provided in the embodiment of the present application.

[0402] For example, when Figure 3a or Figure 4a The second network device in Fig.14 When implemented by the device 1400 shown in the figure, the processor can be used to add an SRH including a first micro-segment segment identifier and a second micro-segment segment identifier to the received message, so that other network devices in the subsequent segment routing network can process the data message according to the first micro-segment segment identifier and the second micro-segment segment identifier. For specific functional implementation, please refer to the method Figure 3a or Figure 4a The method embodiment corresponds to the processing part of the second network device. For example, when Figure 3a or Figure 4a The first network device in the Figure 4a The second network device in Fig.14 When implemented by the network device shown, the processor can be used to obtain the first micro-segment segment identifier and the second micro-segment segment identifier in the received data packet, and process the data packet according to the first micro-segment segment identifier and the second micro-segment segment identifier. The specific function implementation can refer to the processing part of the second network device and the first network device in the method embodiment.

[0403] The communication bus 1402 is used to transmit information between the processor 1401 , the communication interface 1404 and the memory 1403 .

[0404] The memory 1403 may be a read-only memory (ROM), such as an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM), or other optical discs, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.). Alternatively, the memory 1403 may be a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions.

[0405] The memory 1403 may exist independently and be connected to the processor 1401 via the communication bus 1402. The memory 1403 may also be integrated with the processor 1401.

[0406] Optionally, the memory 1403 is used to store program codes or instructions for executing the solution of the present application, and the execution is controlled by the processor 1401. The processor 1401 is used to execute the program code stored in the memory 1403. The program code may include one or more software modules. Optionally, the processor 1401 itself may also store program codes or instructions for executing the solution of the present application.

[0407] The communication interface 1404 uses any transceiver-like device to communicate with other devices or communication networks, and the communication network can be Ethernet, a radio access network (RAN) or a wireless local area network (WLAN), etc. In the embodiment of the present application, the communication interface 1404 can be used to receive messages sent by other network devices in the segment routing network, and can also send messages to other network devices in the segment routing network. The communication interface 1404 can be an Ethernet interface, a Fast Ethernet (FE) interface or a Gigabit Ethernet (GE) interface.

[0408] In a specific implementation, as an embodiment, the device 1400 may include multiple processors, such as Fig.14 1401 and processor 1405 shown in . Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0409] It should be understood that the network devices in the above-mentioned various product forms respectively have any functions of the network devices in the above-mentioned data message processing method embodiments, which will not be repeated here.

[0410] See also Fig.15 , which is a schematic diagram of a network system 1500 provided in an embodiment of the present application.

[0411] The network system provided in the embodiment of the present application may include a first network device 1510 and a second network device 1520, and the first network device 1510 and the second network device 1520 communicate with each other. In one possible manner, the second network device 1520 may execute the above Figure 3a and Figure 3bThe method steps and related optional methods performed by the network device 101 in the embodiment shown in the figure, the first network device 1510 can perform the above Figure 4a or Figure 4b The method steps and related optional methods performed by the network device 102 in the embodiment shown. In one possible method, the first network device 1510 and the second network device 1520 communicate with each other, and the second network device 1520 can perform the above Figure 3a and Figure 3b The method steps and related optional methods performed by the network device 101 in the embodiment shown in the figure, the first network device 1510 can perform the above Figure 4a or Figure 4b The method steps and related optional methods performed by the network device 103 in the embodiment shown. In one possible embodiment, the network system further includes a third network device 1530, and the first network device 1510, the second network device 1520 and the third network device communicate with each other, and the second network device 1520 can perform the above Figure 3a and Figure 3b The method steps and related optional methods performed by the network device 101 in the embodiment shown in the figure, the first network device 1510 can perform the above Figure 4a or Figure 4b In the embodiment shown, the network device 102 may perform the method steps and related optional methods. The first network device 1530 may perform the method steps and related optional methods as described above. Figure 4a or Figure 4b The method steps and related optional modes performed by the network device 103 in the illustrated embodiment. The specific product forms of the network devices 101, 102 and 103 are as described above and will not be described in detail here.

[0412] Those of ordinary skill in the art will appreciate that the various method steps and units described in the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0413] A person skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0414] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical or other form of connection.

[0415] The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0416] In addition, the processing units in the various embodiments of the present application may be distributed among multiple functional units, or integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software functional units.

[0417] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, firmware or a combination thereof, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired or wireless means. The computer-readable storage medium may be any medium that a computer can access or a data storage device such as a server or a data center that includes one or more media integrations. The medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., an optical disk), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0418] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for processing a data message, characterized in that: include: A first network device in a segment routing network receives a first data message, wherein the first data message includes a first micro-segment segment identifier, wherein the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, and the first data message is a data message sent to the second network device; The first network device determines, according to the first micro-segment identifier, a processing action for the first data message; The first network device performs the processing action on the first data message; The first network device determines a processing action for the first data message according to the first micro-segment identifier, including: The first network device determines a processing action for the first data message according to a correspondence between the first micro-segment identifier and the processing action; The first data message also includes a second micro-segment segment identifier, where the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network, the first micro-segment segment identifier and the second micro-segment segment identifier are added to the first data message by the third network device, and the first network device determines a processing action for the first data message according to the first micro-segment segment identifier, including: The first network device determines a processing action for the first data message according to a correspondence between a matching condition and the processing action, wherein the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

2. The method according to claim 1, characterized in that: The first network device and the second network device are the same network device, the first micro-segment segment identifier includes a function part, Before the first network device determines a processing action for the first data message according to the first micro-segment identifier, the method further includes: The first network device determines the functional part to indicate that the first network device determines a processing action for the first data packet according to the first micro-segment identifier.

3. The method according to claim 2, characterized in that When the processing action includes forwarding or marking, the first network device performs the processing action on the first data message, including: The first network device generates a second data packet, wherein the second data packet does not include the first micro-segment segment identifier; The first network device sends the second data packet.

4. The method according to claim 1, characterized in that: The first network device and the second network device are different devices, the first data message further includes a micro-segment node segment identifier, the micro-segment node segment identifier is a segment identifier of the first network device, the micro-segment node segment identifier includes a function part, and the function part is used to indicate: The first network device determines a processing action for the first data packet according to the first micro-segment identifier.

5. The method according to claim 4, characterized in that The segment identifier list of the first data message includes the second micro-segment segment identifier, or The first data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

6. The method according to any one of claims 1 to 5, characterized in that: The segment identifier list of the first data message includes the first micro-segment segment identifier.

7. The method according to claim 5, characterized in that The segment identifier list is carried in a segment routing header or a multi-protocol label switching label stack of the first data packet.

8. A method for processing a data message, characterized in that: include: A second network device in the segment routing network receives the first data message; The second network device determines a first micro-segment segment identifier according to the first data message, where the first micro-segment segment identifier is used to identify a micro-segment of the first network device in the segment routing network, the first data message does not include the first micro-segment segment identifier, and the first data message is a data message sent to the first network device; The second network device determines, according to the first micro-segment identifier, a processing action for the first data message; The second network device performs the processing action on the first data message; The second network device determines a processing action for the first data message according to the first micro-segment identifier, including: The second network device determines, according to the correspondence between the first micro-segment identifier and the processing action, a processing action for the first data message; The method further includes: the second network device further determines a second micro-segment segment identifier according to the received first data message, the second micro-segment segment identifier being used to identify a micro-segment of the second network device; The second network device determines a processing action for the first data message according to the first micro-segment identifier, including: The second network device determines a processing action for the first data message according to a correspondence between a matching condition and the processing action, wherein the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

9. The method according to claim 8, characterized in that The first micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data packet according to the first micro-segment segment identifier.

10. The method according to claim 8, characterized in that When the processing action includes forwarding or marking, the second network device performs the processing action on the first data message, including: The second network device generates a second data packet according to the first data packet, wherein the second data packet includes the first micro-segment segment identifier; The second network device sends the second data packet to the first network device.

11. The method according to claim 8, characterized in that When the processing action includes forwarding or marking, the second network device performs the processing action on the first data message, including: The second network device generates a second data packet according to the first data packet, wherein the second data packet includes the first micro-segment segment identifier and the second micro-segment segment identifier; The second network device sends the second data packet to the first network device.

12. The method according to claim 11, characterized in that The segment identifier list of the second data message includes the second micro-segment segment identifier, or The second data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

13. The method according to any one of claims 8 to 12, characterized in that: The second micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data message according to the second micro-segment segment identifier.

14. The method according to claim 10, 11 or 12, characterized in that The second data message also includes a micro-segment node segment identifier, where the micro-segment node segment identifier is a segment identifier of a third network device in the segment routing network, and the micro-segment node segment identifier is used to instruct the third network device to process the second data message according to the first micro-segment segment identifier.

15. A first network device, applied to a segment routing network, characterized in that: include: A receiving unit, configured to receive a first data message, wherein the first data message includes a first micro-segment segment identifier, the first micro-segment segment identifier is used to identify a micro-segment of a second network device in the segment routing network, and the first data message is a data message sent to the second network device; a processing unit, configured to determine a processing action for the first data message according to the first micro-segment identifier; The processing unit is used to perform the processing action on the first data message; The processing unit is used to determine a processing action for the first data message according to the first micro-segment identifier, specifically: The processing unit is used to determine a processing action for the first data message according to the correspondence between the first micro-segment identifier and the processing action; The first data message also includes a second micro-segment segment identifier, where the second micro-segment segment identifier is used to identify a micro-segment of a third network device in the segment routing network, and the first micro-segment segment identifier and the second micro-segment segment identifier are added to the first data message by the third network device. The processing unit is used to determine a processing action for the first data message according to the first micro-segment segment identifier, specifically: The processing unit is used to determine the processing action for the first data message according to the correspondence between the matching condition and the processing action, and the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

16. The first network device according to claim 15, characterized in that: The first network device and the second network device are the same network device, the first micro-segment segment identifier includes a function part, Before the processing unit is used to determine a processing action for the first data message according to the first micro-segment identifier, the processing unit is further specifically used to: Determining the functional part is used to indicate: the processing unit determines a processing action for the first data message according to the first micro-segment identifier.

17. The first network device according to claim 16, further comprising a sending unit, characterized in that: When the processing action includes forwarding or marking, the processing unit performs the processing action on the first data message, specifically: The processing unit generates a second data message, wherein the second data message does not include the first micro-segment segment identifier; The sending unit is used to send the second data message.

18. The first network device according to claim 15, characterized in that: The first network device and the second network device are different devices, the first data message further includes a micro-segment node segment identifier, the micro-segment node segment identifier is a segment identifier of the first network device, the micro-segment node segment identifier includes a function part, and the function part is used to indicate: The processing unit determines a processing action for the first data message according to the first micro-segment identifier.

19. The first network device according to claim 15, characterized in that: The segment identifier list of the first data message includes the second micro-segment segment identifier, or The first data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

20. The first network device according to any one of claims 15 to 19, characterized in that: The segment identifier list of the first data message includes the first micro-segment segment identifier.

21. The first network device according to claim 19, characterized in that: The segment identifier list is carried in a segment routing header or a multi-protocol label switching label stack of the first data packet.

22. A second network device, applied to a segment routing network, characterized in that: include: A receiving unit, configured to receive a first data message; a processing unit, configured to determine a first micro-segment segment identifier according to the first data message, wherein the first micro-segment segment identifier is used to identify a micro-segment of a first network device in the segment routing network, the first data message does not include the first micro-segment segment identifier, and the first data message is a data message sent to the first network device; The processing unit is further configured to determine a processing action for the first data message according to the first micro-segment identifier; The processing unit is further configured to perform the processing action on the first data message; The processing unit is further configured to determine a processing action for the first data message according to the first micro-segment identifier, specifically: The processing unit is used to determine a processing action for the first data message according to the correspondence between the first micro-segment identifier and the processing action; It also includes: the processing unit is further used to determine a second micro-segment segment identifier according to the received first data message, and the second micro-segment segment identifier is used to identify a micro-segment of the second network device; The processing unit is further configured to determine a processing action for the first data message according to the first micro-segment identifier, specifically: The processing unit determines a processing action for the first data message according to a correspondence between a matching condition and the processing action, wherein the matching condition includes the first micro-segment segment identifier and the second micro-segment segment identifier.

23. The second network device according to claim 22, characterized in that: The first micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data packet according to the first micro-segment segment identifier.

24. The second network device according to claim 22, further comprising a sending unit, characterized in that: When the processing action includes forwarding or marking, the processing unit is further configured to perform the processing action on the first data message, specifically: The processing unit is configured to generate a second data message according to the first data message, wherein the second data message includes the first micro-segment segment identifier; The sending unit is used to send the second data message to the first network device.

25. The second network device according to claim 23, further comprising a sending unit, characterized in that: When the processing action includes forwarding or marking, the processing unit is further configured to perform the processing action on the first data message, including: The processing unit is configured to generate a second data message according to the first data message, wherein the second data message includes the first micro-segment segment identifier and a second micro-segment segment identifier; The processing unit is used to send the second data message to the first network device.

26. The second network device according to claim 25, characterized in that: The segment identifier list of the second data message includes the second micro-segment segment identifier, or The second data message also includes metadata, and the metadata includes the second micro-segment segment identifier.

27. The second network device according to claim 25 or 26, characterized in that: The second micro-segment segment identifier includes a functional part, and the functional part is used to indicate: the second network device determines a processing action for the first data message according to the second micro-segment segment identifier.

28. The second network device according to any one of claims 24 to 26, characterized in that: The second data message also includes a micro-segment node segment identifier, where the micro-segment node segment identifier is a segment identifier of a third network device in the segment routing network, and the micro-segment node segment identifier is used to instruct the third network device to process the second data message according to the first micro-segment segment identifier.

29. A network system, characterized in that: The network system includes a first network device and a second network device, the first network device is the first network device of any one of claims 15 to 21, and the second network device is the second network device of any one of claims 22 to 28.

30. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the method according to any one of claims 1 to 14.

Images