A message processing method and device

Abstract

The embodiment of the application discloses a message processing method. A head node performing tunnel encapsulation on an original user message can perform hash calculation on a first checksum of the original user message to obtain first check information, and encapsulate the first check information into a tunnel header to obtain a first message. After the head node forwards the first message, a node receiving the first message can verify the integrity of the first message according to the first check information, so as to determine whether the user message in the received first message is tampered with, and further determine whether the message payload of the user message is tampered with.

Description

[0001] This application claims priority to the Chinese Patent Application No. 202011053857.1, filed on September 29, 2020, and entitled "IP Transmission Method for Ensuring User Message Integrity", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the field of communication, and in particular to a message processing method and device. BACKGROUND

[0003] The message transmitted in an Internet Protocol (IP) network can be referred to as an IP message.

[0004] Currently, in the transmission process of the IP message, the message payload in the IP message is at risk of being tampered with. How to detect whether the message payload of the IP message is tampered with is a problem to be solved at present. SUMMARY

[0005] Embodiments of the present application provide a message processing method and device, which can determine whether the message payload of the IP message is tampered with.

[0006] In a first aspect, an embodiment of the present application provides a packet processing method, which can be executed by a first communication device. In one example, the first communication device can obtain a first packet, the first packet being an IP packet, and the first packet comprising a tunnel header and a user packet. The tunnel header of the first packet comprises first check information, and the first check information is obtained by performing a hash calculation on first target content, and the first target content comprises a first checksum of an original user packet. After obtaining the first packet, the first communication device can send the first packet. Since the tunnel header of the first packet comprises the first check information, which is obtained by performing a hash calculation on the first target content comprising the first checksum capable of checking the original user packet, the user packet can be checked according to the first check information. Therefore, according to the present application, the communication device receiving the first packet can verify whether the user packet is tampered by using the first check information, so as to determine whether the IP packet payload of the user packet is tampered. In one example, if second check information obtained by performing a hash calculation on second target content by a second communication device does not match the first check information, it is indicated that the second target content is different from the first target content, and further, it is determined that the second checksum in the second target content is different from the first checksum, and thus it is determined that the user packet in the first packet is tampered, and further, it is determined that the payload of the user packet is tampered. The second target content can comprise a second checksum of the user packet. Moreover, the first target content has a smaller data amount relative to the entire user packet. Therefore, compared with a scheme of performing a hash calculation on the entire user packet to verify whether the packet payload of the user packet is tampered, the present application has a smaller resource consumption.

[0007] In an implementation, the first checksum is located in the payload of the first message. Therefore, the communication device that performs the integrity check on the first message has to parse the payload of the first message to match the first checksum. For an intermediate node in the IP network that forwards the first message, parsing the payload of the first message requires extra resource of the intermediate node, because the intermediate node usually parses the tunnel header of the first message and forwards the first message according to the tunnel header. To avoid this problem, in an implementation of the embodiments, the head node that encapsulates the original user message into the first message can encapsulate the first information into the tunnel header of the first message, wherein the first information indicates the first checksum, so that the communication device that receives the first message can obtain the first checksum indicated by the first information according to the first information in the tunnel header of the first message, and then match the first checksum to verify the integrity of the first message.

[0008] In an implementation, the user message further includes a second checksum of the user message. If the first message is not tampered during the forwarding, the content of the user message is the same as the content of the original user message, i.e., the first checksum is the same as the second checksum.

[0009] In an implementation, the user message further includes a second checksum of the user message. If the first message is tampered during the forwarding, the content of the user message can be different from the content of the original user message, and in this case, the first checksum can be different from the second checksum.

[0010] In an implementation, the first communication device is a head node that encapsulates the original user message into the first message. In this case, the first communication device can receive the original user message sent by a user equipment, and encapsulate a tunnel header for the original user message to obtain the first message.

[0011] In an implementation, the first communication device can be an intermediate node in the forwarding path of the first message. In this case, the first communication device can receive the first message sent by the head node that encapsulates the original user message into the first message.

[0012] In a second aspect, an embodiment of the present application provides a packet processing method, which can be executed by a second communication device. In one example, the second communication device can receive a first packet, the first packet being an IP packet, and the first packet comprising a tunnel header and a user packet. The tunnel header of the first packet comprises first check information, which is obtained by performing a hash calculation on first target content, and the first target content comprising a first checksum of an original user packet. Since the first check information is obtained by performing a hash calculation on the first target content comprising the first checksum of the original user packet, the user packet can be checked according to the first check information. After receiving the first packet, the second communication device can perform integrity verification on the first packet according to the first check information, so as to determine whether the packet payload of the user packet is tampered. In one example, if second check information obtained by performing a hash calculation on second target content by the second communication device does not match the first check information, it is determined that the second target content is different from the first target content, and further, it is determined that the second checksum in the second target content is different from the first checksum, and thus it is determined that the user packet in the first packet is tampered, and further, it is determined that the payload of the user packet is tampered. The second target content can comprise a second checksum of the user packet. It can be seen that, by using the present solution, the second communication device can verify whether the packet payload of the user packet is tampered by using the first check information. Moreover, the first target content has a smaller data amount relative to the entire user packet. Therefore, compared with a solution of performing a hash calculation on the entire user packet to verify whether the packet payload of the user packet is tampered, the present solution has a smaller resource consumption.

[0013] In one implementation, the tunnel header further comprises first information, and the first information is used to indicate the first checksum.

[0014] In one implementation, the second communication device performs integrity verification on the first packet according to the first check information. In a specific implementation, the second communication device can perform a hash calculation on second target content of the first packet to obtain second check information, and perform matching verification on the first check information and the second check information. If the first check information and the second check information match, for example, the first check information and the second check information are the same, the second communication device can determine that the first packet passes the integrity verification. If the first check information and the second check information do not match, for example, the first check information and the second check information are different, the second communication device can determine that the first packet does not pass the integrity verification.

[0015] In one implementation, the user message includes a second checksum of the user message. The second target content of the second verification information calculated by the second communication device may include the second checksum. In this case, if the second communication device determines that the first verification information and the second verification information match, it can be determined that the user message has not been tampered with, that is, the user message in message 1 is the original user message, and further determines that the message payload of the user message has not been tampered with. If the second communication device determines that the first verification information and the second verification information do not match, it indicates that the message payload of the user message has been tampered with.

[0016] In one implementation, if the tunnel header of the first message includes first information, the second communication device performs integrity verification on the first message based on the first verification information. In a specific implementation, the second communication device may first determine the first checksum based on the first information; then, perform a hash calculation based on the determined first checksum to obtain second verification information; and perform matching verification on the first verification information and the second verification information. In this manner, intermediate nodes on the forwarding path of the first message can match and verify the first verification information without parsing the message payload of the first message, thereby avoiding additional resource overhead caused by parsing the message payload of the first message.

[0017] In one implementation, if the second verification information is calculated based on the first information in the tunnel header, then if the second communication device performs a matching check on the first verification information and determines that the first verification information and the second verification information do not match, it indicates that the source IP address in the tunnel header of the first message or other content in the second target content, such as the SID list, has been tampered with.

[0018] In some embodiments, if the second check information is calculated according to the first information in the tunnel header. If the second communication device determines that the first check information and the second check information 2 match after the matching check of the first check information and the second check information 2, it indicates that the source IP address in the tunnel header of the first message or other contents in the second target content, such as the SID list, is not tampered with. However, this does not mean that the message payload of the user message is not tampered with. Because the first information in the tunnel header is used to indicate the first checksum, and the first checksum is the checksum included in the original user message. If the message payload of the user message is not tampered with, the first checksum indicated by the first information in the tunnel header of the first message and the second checksum in the user message should be the same. In view of this, in an example, in order to further determine whether the message payload of the user message is tampered with, the second communication device can compare the first checksum indicated by the first information in the tunnel header of the first message and the second checksum in the user message, if they are the same, it can be determined that the message payload of the user message is not tampered with. If the first checksum indicated by the first information in the tunnel header of the first message and the second checksum in the user message are different, it indicates that the message payload of the user message may be tampered with.

[0019] In an implementation manner, if the second communication device determines that the message payload of the user message is not tampered with, the second communication device can forward the first message.

[0020] In an implementation manner, if the second communication device determines that the message payload of the user message is tampered with, the second communication device can discard the first message, so as to avoid that the illegal message continues to be forwarded in the network. Alternatively, the second communication device can record the mismatch of the first check information and the second check information and the related information of the first message in the log.

[0021] In an implementation manner, the second communication device is an intermediate node or a tail node in the forwarding path of the first message.

[0022] In the above first aspect and second aspect:

[0023] In an implementation manner, the first check information is a keyed-Hash Message Authentication Code (HMAC). That is, the first check information is calculated according to the first target content by keyed-Hash.

[0024] In an implementation manner, the tunnel header can include an extension header, and the extension header includes the first check information.

[0025] In an implementation, the tunnel header includes an extended Type Length Value (TLV) field, and the extended TLV field includes the first check information.

[0026] In an implementation, the source IP address of the first packet can be used to indicate a source node in the first packet forwarding path. In some embodiments, when the first packet is tampered in the forwarding process, the source IP address of the first packet can help analyze the attack behavior of network hackers. In view of this, the first target content further includes the source IP address of the first packet. In this way, the first check information can also be used to verify the legitimacy of the source IP address of the first packet.

[0027] In an implementation, the tunnel header further includes second information, which is used to indicate a key and / or algorithm used for the hash calculation. For this case, the second communication device can determine the key and / or algorithm used for calculating the second check information according to the second information before calculating the second check information according to the second target content, so as to calculate the second check information by using the determined key and / or algorithm and the second target content. In an example, when the first check information is HMAC, the second information is used to indicate the identification of the key hash algorithm used for calculating the first check information.

[0028] In an implementation, the tunnel header further includes third information, which indicates the target content used when performing the hash check for matching verification of the first check information. For this case, the second communication device can determine the second target content according to the third information before calculating the second check information according to the second target content.

[0029] In an implementation, the first packet is an Internet Protocol version 6 (IPv6) packet.

[0030] In an implementation, when the first packet is an IPv6 packet, the tunnel header includes a Segment Routing Header (SRH), and the first check information can be carried in the SRH. At this time, the first packet is an SRv6 packet.

[0031] In an implementation, when the first packet is an SRv6 packet, the SID list in the SRH of the first packet indicates a forwarding path of the first packet in an SRv6 network domain. Therefore, the SID list is key information for guiding the forwarding of the first packet. If the SID list is tampered with, the first packet will be forwarded according to an incorrect path. In view of this, in an implementation, the first target content for which the first check information is calculated can further include the SID list. In this way, the first check information can also be used to determine whether the SID list is tampered with.

[0032] In an implementation, the first packet is a Bit Index Explicit Replication version 6 Internet Protocol Encapsulation (BIERv6) packet.

[0033] In an implementation, when the first packet is a BIERv6 packet, the tunnel header includes an extended Destination Options Header (DoH), and the first check information can be carried in the DoH.

[0034] In an implementation, the first packet is an Internet Protocol version 4 (IPv4) packet.

[0035] In an implementation, the user packet includes an ICMP header, and in this case, the second checksum of the user packet can be carried in the ICMP header.

[0036] In an implementation, the user packet includes a TCP header, and in this case, the second checksum of the user packet can be carried in the TCP header.

[0037] In an implementation, the user packet includes a UDP header, and in this case, the second checksum of the user packet can be carried in the UDP header.

[0038] In a third aspect, the present application provides a first communication apparatus, comprising: a transceiver unit and a processing unit. The transceiver unit is configured to perform the transceiving operations performed by the first communication apparatus of the first aspect and any one of the first aspect. The processing unit is configured to perform other operations performed by the first communication apparatus of the first aspect and any one of the first aspect, except the transceiving operations.

[0039] In a fourth aspect, the present application provides a first communication apparatus, comprising: a memory and a processor; the memory is configured to store program code; and the processor is configured to run instructions in the program code, so that the first communication apparatus performs the method of the first aspect and any one of the first aspect.

[0040] In a fifth aspect, the present application provides a first communication device, comprising a communication interface and a processor, wherein the communication interface is configured to perform the transceiving operation performed by the first communication device according to the first aspect and any one of the first aspect, and the processor is configured to perform the operation other than the transceiving operation performed by the first communication device according to the first aspect and any one of the first aspect.

[0041] In a sixth aspect, the present application provides a second communication device, comprising a transceiving unit and a processing unit, wherein the transceiving unit is configured to perform the transceiving operation performed by the second communication device according to the second aspect and any one of the second aspect, and the processing unit is configured to perform the operation other than the transceiving operation performed by the second communication device according to the second aspect and any one of the second aspect.

[0042] In a seventh aspect, the present application provides a second communication device, comprising a memory and a processor, wherein the memory is configured to store program codes, and the processor is configured to execute the instructions in the program codes, so that the second communication device performs the method according to the second aspect and any one of the second aspect.

[0043] In an eighth aspect, the present application provides a second communication device, comprising a communication interface and a processor, wherein the communication interface is configured to perform the transceiving operation performed by the second communication device according to the second aspect and any one of the second aspect, and the processor is configured to perform the operation other than the transceiving operation performed by the second communication device according to the second aspect and any one of the second aspect.

[0044] In a ninth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores instructions, when the instructions are run on a computer, the computer is caused to perform the method according to the first aspect and any one of the first aspect, or the computer is caused to perform the method according to the second aspect and any one of the second aspect.

[0045] In a tenth aspect, the present application provides a communication system, comprising the first communication device according to the third aspect or the fourth aspect or the fifth aspect, and the second communication device according to the sixth aspect or the seventh aspect or the eighth aspect. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only represent some embodiments described in the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without any creative effort.

[0047] Figure 1a This is a schematic diagram of an exemplary application scenario.

[0048] Figure 1b This is a schematic diagram of an IP packet structure provided by an embodiment of the present application.

[0049] Figure 2 This is a signaling interaction diagram of a packet processing method provided by an embodiment of the present application.

[0050] Figure 3a This is a schematic diagram of an IPv4 extension header provided by an embodiment of the present application.

[0051] Figure 3b This is a schematic diagram of a TLV field provided by an embodiment of the present application.

[0052] Figure 4 This is a flowchart of a packet processing method provided by an embodiment of the present application.

[0053] Figure 5 This is a flowchart of a packet processing method provided by an embodiment of the present application.

[0054] Figure 6 This is a schematic diagram of a communication device provided by an embodiment of the present application.

[0055] Figure 7 This is a schematic diagram of a communication device provided by an embodiment of the present application.

[0056] Figure 8 This is a schematic diagram of a communication device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0057] The embodiment of the present application provides a packet processing method, which can determine whether the packet payload of an IP packet is tampered.

[0058] For the convenience of understanding, first, the possible application scenarios of the embodiments of the present application are introduced.

[0059] Referring to Figure 1a This is a schematic diagram of an exemplary application scenario.

[0060] As Figure 1aAs shown, host H1 can send a packet to host H2 through network domain 100. Network domain 100 can be an IP network. In one example, network domain 100 can be an operator network. H1 can send a user packet to communication device R1 in network domain 100 through customer edge (CE) device CE1. After receiving the user packet, communication device R1 can re-encapsulate the user packet to obtain an IP packet. In one example, communication device R1 can forward the IP packet to communication device R4 in network domain 100. Communication device R4 can decapsulate the received IP packet to obtain the user packet, and send the user packet to H2 through CE2. In another example, communication device R1 can forward the IP packet to communication device R5 in network domain 100. Communication device R5 can decapsulate the received IP packet to obtain the user packet, and send the user packet to H3 through CE3.

[0061] Figure 1a The network between host H1 and communication device R1 can be a user network, for example, an enterprise network. The network can also be an IP network. Similarly, the network between communication device R4 and host H2, and the network between communication device R5 and host H3 can also be IP networks. In this case, the user packet can be an IP packet, which can be an Internet Protocol version 4 (IPv4) packet or an Internet Protocol version 6 (IPv6) packet. The application embodiments are not limited in this regard. The technique of re-encapsulating the user packet sent by H1 by communication device R1 can be referred to as IPinIP technique.

[0062] In an embodiment of the present application, the network domain 100 can deploy an IPv4 network or an IPv6 network. When an IPv6 network is deployed in the network domain 100, the IP message obtained after the communication device R1 encapsulates the user message can be an IPv6 message. In one example, the network domain 100 applies segment routing (SR) technology to the forwarding of IPv6 messages. At this time, the forwarded IPv6 message in the network domain 100 can also be referred to as an SRv6 message. In another example, the network 100 can also deploy a multicast network and apply the bit index explicit replication sixth edition Internet Protocol encapsulation (BIERv6) protocol to multicast technology. At this time, the forwarded IPv6 message in the network domain 100 can also be referred to as a BIERv6 message. Among them, multicast technology refers to a communication technology in which a single data sender corresponds to multiple data receivers, which is not described in detail here.

[0063] Regarding the structure of the IP message encapsulated by the communication device R1, please refer to Figure 1b To understand, Figure 1b A schematic diagram of the structure of an IP message provided in an embodiment of the present application. Figure 1b As shown, after receiving the original user message, the communication device R1 encapsulates the original user message with a tunnel header, wherein if an IPv6 network is deployed in the network domain 100, the tunnel header may include an IPv6 and an IPv6 extension header; if an IPv4 network is deployed in the network domain 100, the tunnel header may include an IPv4 header and an extension header. Figure 1b When the message is an SRv6 message, the IPv6 extension header may be a segment routing header (SRH); Figure 1b When the message is a BIERv6 message, the IPv6 extension header can be a destination options header (DoH).

[0064] When user messages are transmitted through network domain 100, it is particularly important to determine whether the message payload has been tampered with. For example, assume H1 is a server and H2 is a user terminal. The user message sent from H1 to H2 is a video service message. If the message payload of the user message has been tampered with, the video image viewed by the user through the user terminal will be the tampered image, resulting in a poor user experience.

[0065] In order to ensure the security of the IP packet transmission in the IP network, in an example, an authentication header (AH) can be used to determine whether the packet payload of the user packet is tampered when the user packet is transmitted in the IP network. As an example, R1 can encapsulate an AH for the user packet when encapsulating the user packet, where the AH includes an integrity check value (ICV) field carrying a value calculated by using a key and a hash algorithm on the entire user packet. After the communication device R1 encapsulates the user packet, an IP packet is obtained, where the entire user packet is the packet payload of the IP packet. After the communication device R1 forwards the IP packet carrying the AH, other communication devices (such as intermediate nodes or edge nodes) receiving the IP packet in the network domain 100 can perform integrity verification on the IP packet by using the ICV field in the AH, so as to determine whether the packet payload of the IP packet is tampered. In an example, after the communication device R5 receives the IP packet, the communication device R5 can calculate the entire user packet received by using the key and the hash algorithm, obtain a calculation result, and compare the calculation result with the value of the ICV field in the IP packet. If the two are the same, it is determined that the packet payload of the IP packet is not tampered when the IP packet is transmitted in the network domain 100, and accordingly, the packet payload of the user packet is also not tampered. If the two are different, it is determined that the packet payload of the IP packet is tampered when the IP packet is transmitted in the network domain 100, and accordingly, the possibility that the packet payload of the user packet is tampered is also very high.

[0066] It should be noted that the communication device R1 can also encapsulate an IPv4 or IPv6 header and other extension headers for the user packet when encapsulating the user packet, which will not be described in detail here.

[0067] In addition, detailed description of the AH can refer to the description part of request for comments (RFC) 4301 and RFC 4302, which will not be described in detail here.

[0068] Although the use of the AH can determine whether the packet payload is tampered when the IP packet is transmitted in the IP network, both the communication device generating the AH (such as the communication device R1) and the communication device performing verification on the AH (such as the communication device R2 or R4 or R5) need to perform hash calculation on the entire IP packet payload (i.e., the entire user packet), which will consume a large amount of computing resources.

[0069] In view of this, the embodiment of the present application provides a packet processing method, which can not only determine whether the packet payload of an IP packet is tampered, but also consume less computing resources. Next, the packet processing method provided by the embodiment of the present application is introduced in combination with the drawings.

[0070] Figure 2 A signaling interaction diagram of the packet processing method provided by the embodiment of the present application.

[0071] Figure 2 The communication device 1 shown in the figure can be Figure 1a The communication device R1 shown in the figure can also be Figure 1a The communication device R1b shown in the figure can also be Figure 1a The communication device R2 or the communication device R3 shown in the figure. Figure 2 The communication device 2 shown in the figure can be Figure 1a The communication device R1b shown in the figure can also be Figure 1a The communication device R2 shown in the figure can also be Figure 1a The communication device R3 shown in the figure can also be Figure 1a The communication device R4 or the communication device R5 shown in the figure.

[0072] The communication device mentioned in the embodiment of the present application can be a switch, a router or other network equipment, or a part of a component on the network equipment, for example, a single board, a line card or a functional module on the network equipment, which is not limited in the embodiment of the present application. The communication devices can be directly connected through an Ethernet cable or an optical cable, for example, but are not limited thereto.

[0073] Figure 2 The method 100 shown in the figure can include the following S101-S104, for example.

[0074] S101: The communication device 1 acquires a packet 1, the packet 1 including a tunnel header and a user packet 1, the user packet 1 including a checksum 1 for verifying the user packet 1, the tunnel header including a check information 1, the check information 1 being obtained by hash calculation according to target content 1, the target content 1 including a checksum 2 included in an original user packet.

[0075] In the embodiment of the present application, the communication device 1 acquiring the packet 1 can have various implementation manners in specific implementation.

[0076] In one example, the communication device 1 can generate the packet 1 according to the original user packet. That is, the communication device 1 is a head node performing tunnel encapsulation on the original user packet. For example, when the communication device 1 is an edge node of an IP network domain, for example, a router or a switch, the communication device 1 can generate the packet 1 according to the original user packet. Figure 1aIn the case of the communication device R1 shown, the communication device 1 can re-encapsulate the received original user packet, e.g., packet 2, to obtain packet 1. At this time, packet 2 can be taken as the packet payload of packet 1. For this case, the user packet 1 is the original user packet (i.e., packet 2). The packet 2 can be an IPv4 packet or an IPv6 packet, which is not limited in the embodiments of the present application. As shown in the figure, packet 2 can include an IP header and an IP packet payload. The original user packet refers to a packet sent by a user device without tampering. For example, in the scenario shown, the original user packet can be a packet sent by the host H1. Figure 1b Figure 1a As shown in the figure, the original user packet can be a packet sent by the host H1.

[0077] In one example, packet 2 can include an Internet Control Message Protocol (ICMP) header in addition to the IP header and the IP packet payload. When packet 2 includes the ICMP header, the ICMP header can include a checksum 2 for verifying packet 2. The checksum 2 can be obtained by adding and truncating fields in the packet payload of packet 2. As described above, if the communication device 1 is a head node performing tunnel encapsulation on the original user packet, the user packet 1 is packet 2, and for this case, the checksum 1 in the user packet 1 is equal to the checksum 2 included in the ICMP header of packet 2. For the ICMP header and the checksum 2 in the ICMP header, refer to the description in RFC 792 and RFC 4443, which will not be described in detail herein.

[0078] In one example, packet 2 can include a Transmission Control Protocol (TCP) header in addition to the IP header and the IP packet payload. When packet 2 includes the TCP header, the TCP header can include a checksum 2 for verifying the packet payload of packet 2, which is obtained by adding and truncating fields in the packet payload of packet 2. As described above, if the communication device 1 is a head node performing tunnel encapsulation on the original user packet, the user packet 1 is packet 2, and for this case, the checksum 1 in the user packet 1 is equal to the checksum 2 included in the TCP header of packet 2. For the TCP header and the checksum 2 in the TCP header, refer to the description in RFC 793, which will not be described in detail herein.

[0079] ​In another example, in addition to the IP header and IP message payload, message 2 may also include a User Datagram Protocol (UDP) header. When message 2 includes a UDP header, the UDP header may include a checksum 2 for verifying the message payload of message 2. The checksum 2 is obtained by summing and intercepting the fields in the message payload of message 2. As described above, if communication device 1 is the head node that performs tunnel encapsulation on the original user message, user message 1 is message 2. In this case, the checksum 1 in user message 1 is equal to the checksum 2 included in the UDP header of message 2. For details about the UDP header and the checksum 2 in the UDP header, please refer to the description of RFC768, which will not be described in detail here.

[0080] In another example, the communication device 1 may receive the message 1 from another communication device. For example, the communication device 1 is an intermediate node in the IP network domain, such as Figure 1a If the communication device R2 is shown, the communication device 1 can receive the message 1 from the communication device R1b or the communication device R1. It can be understood that if the message 1 received by the communication device 1 has not been tampered with during the transmission process, the user message 1 is the original user message. At this time, the content of the user message 1 is the same as the content of the original user message. In this case, the checksum 1 in the user message 1 is the same as the aforementioned checksum 2. If the message payload of the message 1 is tampered with during the transmission process, the user message 1 may be different from the original user message. At this time, the content of the user message 1 is different from the content of the original user message. In this case, the checksum 1 in the user message 1 may be different from the checksum 2. In an embodiment of the present application, the message 1 includes verification information 1, and the verification information 1 is obtained by hash calculation based on the target content 1, and the target content 1 includes the aforementioned checksum 2. It can be understood that since the checksum2 can be used to verify the message payload of message 2 (i.e., the original user message), and the target content 1 of the verification information 1 calculated includes the checksum2, the verification information 1 can verify the message payload of message 2.

[0081] In one example, the check information 1 can be a keyed-hashing for message authentication (HMAC) calculated according to the target content 1. There can be multiple ways to calculate the keyed-hashing for message authentication according to the target content 1. In one way, the keyed-hashing for message authentication can be calculated according to the target content 1. In another way, a first calculation can be performed on the target content 1 to obtain a calculation result 1, and then the keyed-hashing for message authentication can be calculated according to the calculation result 1. Take the target content 1 and the checksum 2 as an example.

[0082] Example 1: The keyed-hashing for message authentication can be calculated directly according to the checksum 2, i.e., the key and the checksum 2 are taken as factors of the hashing calculation, thereby obtaining the check information 1. Example 2: A first calculation can be performed on the checksum 2 to obtain a calculation result 1. For example, the bits of the checksum 2 are inverted, and assuming that the checksum 2 is 0x55, the calculation result 1 is 0xAA. Then, the keyed-hashing for message authentication is calculated according to the calculation result 1, i.e., the key and the calculation result 1 are taken as factors of the hashing calculation, thereby obtaining the check information 1.

[0083] In one example, the tunnel header of the packet 1 includes an extension header, and the check information 1 is carried in the extension header of the tunnel header. In another example, the extension header of the packet 1 includes an extended type length value (TLV) field, and the check information 1 is carried in the extended TLV field. In yet another example, the extended TLV field can also be a field in the extension header of the tunnel header.

[0084] In one example, considering that the checksum 2 used to calculate the check information 1 is located in the user packet 1, for a communication device that performs integrity check on the packet 1 using the check information 1, the user packet 1 must be parsed to perform matching verification on the check information 1. If the intermediate nodes that forward the packet 1 are enabled to perform integrity check on the packet 1, for the intermediate nodes that forward the packet in the IP network domain, parsing the user packet 1 requires additional consumption of resources of the intermediate nodes, because in general, the intermediate nodes parse the tunnel header of the packet 1 and perform packet forwarding according to the tunnel header.

[0085] To avoid this problem, in one implementation of the embodiments of the present application, the head node (e.g., the communication device 1) that encapsulates the original user packet into a tunnel packet can encapsulate information 3 into the tunnel header of the packet 1, where the information 3 is used to indicate the checksum 2, so that the communication device that receives the packet 1 can perform matching verification on the check information 1 according to the information 3 in the tunnel header of the packet 1. The embodiments of the present application do not specifically limit the specific form of the information 3. In one example, the information 3 can be the checksum 2. In another example, the information 3 can be a value calculated according to the checksum 2 according to a certain rule. For example, the information 3 can be a value obtained by performing first calculation on the checksum 2. In another example, the information 3 can be a value obtained by performing negation on one or more bits of the checksum 2.

[0086] It can be understood that if the information 3 in the tunnel header of the packet 1 is not tampered with during transmission, the checksum value indicated by the information 3 included in the tunnel header of the packet 1 is the checksum 2. In one example, if the information 3 is the checksum 2, the checksum 2 is included in the tunnel header of the packet 1. In another example, if the information 3 is a value calculated according to the checksum 2 according to a certain rule, the value calculated according to the checksum 2 according to a certain rule is included in the tunnel header of the packet 1. If the information 3 in the tunnel header of the packet 1 is tampered with during transmission, the checksum value indicated by the information 3 included in the tunnel header of the packet 1 can be another checksum value, for example, the checksum 1, or the checksum 3.

[0087] In the following description, by default, the checksum value included in the tunnel header of the packet 1 is the checksum 2, unless otherwise specified.

[0088] In one example, considering that for the packet 1, the source IP address of the packet 1 can be used to indicate the source node in the packet 1 forwarding path, the network hacker can tamper with the packet 1 when the packet 1 is forwarded in the IP network domain. In some embodiments, the attack behavior of the network hacker can be analyzed according to the source IP address of the packet 1. For example, if the source IP address of the packet 1 is changed to a certain IP address, it can be determined that the network hacker has tampered with the packet 1. Figure 1aThe illustrated scenario is used as an example. If the communication device R3 determines that the message 1 is tampered, the analysis device, such as a control management entity, can determine that the network hacker tampers the message 1 in the process of forwarding the message 1 from the communication device R1 to the communication device R3 according to the source IP address of the message 1 (i.e. the address of the communication device R1). However, if the source IP address of the message 1 is also tampered, the control management entity cannot analyze the attack behavior of the network hacker. Therefore, in one example, the target content 1 used to calculate the check information 1 can further include the source IP address of the message 1. In this way, the check information 1 can also be used to verify the legitimacy of the source IP address of the message 1.

[0089] In one example, the message 1 can include information 1 in the tunnel header, the information 1 being used to indicate the key and / or algorithm used by the hash algorithm to calculate the check information 1. In one example, the information 1 can be an index of the key and / or algorithm, for example. The communication device performing integrity verification on the message 1 can obtain the key and / or algorithm from the local according to the index, and then perform integrity verification on the message 1 using the key and / or algorithm.

[0090] In one example, the message 1 can further include information 2 in the tunnel header, the information 2 being used to indicate the target content 2 used in the hash check. The communication device receiving the message 1 can determine the target content 2 according to the information 2, and then perform matching verification on the check information 1 according to the target content 2, so as to determine the integrity of the message 1.

[0091] In the embodiments of the present application, the aforementioned check information 1 can be carried in the extension header of the message 1. In one example, the check information 1, the information 3, the information 1 and the information 2 in the aforementioned tunnel header can be carried in the extension header. Figure 3a An IPv4 extension header provided in the embodiments of the present application is shown in the figure. The protocol field is used to indicate the type of the next message header of the extension header. In one example, the protocol field can be used to indicate the type of the message 2. The checksum field is used to carry the information 3. The HMAC Key ID field is used to carry the information 1. In one example, the check information 1 is HMAC, and the HMAC Key ID field is used to carry the identification of the key hash algorithm used to calculate the check information 1. The HMAC field is used to carry the check information 1. The information 2 can be defined by the protocol, i.e. according to the target content 2 used to calculate the check information 1. Figure 3aIn the embodiment of the present application, the extension header may also be an IPv6 extension header. The format of the IPv6 extension header may be similar to that of the IPv4 extension header, except that the IPv6 extension header no longer includes the protocol field but includes the next header field. The IPv6 extension header will not be described in detail here. When the first verification information is HMAC, Figure 3a The extended header shown may also be called an HMAC header.

[0092] In an embodiment of the present application, when the message 1 may be an IPv6 message, the indication information 1 may also be carried using an existing IPv6 extension header.

[0093] In one example, if the IP network domain applies SR technology, the message 1 may be an SRv6 message. In this case, the aforementioned check information 1 may be carried in the SRH of the message 1. In one example, the check information 1, checksum 2, information 1, and information 2 in the tunnel header may be carried by an extended TLV field in the SRH. For more information about the TLV field, please refer to Figure 3b , Figure 3b A schematic diagram of a TLV field provided in an embodiment of the present application, wherein the type field can be used to carry information 2; the checksum field is used to carry checksum 2; the HMAC Key ID field is used to carry information 1; and the HMAC field is used to carry verification information 1.

[0094] When message 1 is an SRv6 message, the segment identifiers list (SID list) in the SRH of message 1 indicates the forwarding path of message 1 in the SRv6 network domain. Therefore, the SID list is the key information guiding the forwarding of message 1. If the SID list is tampered with, it will cause message 1 to be forwarded along the wrong path. In view of this, in one implementation, if message 1 is an SRv6 message, the target content 1 of the verification information 1 calculated above may also include the SID list. In this way, the verification information 1 can also be used to determine whether the SID list has been tampered with.

[0095] In another example, if the IP network domain deploys a multicast network and applies the BIERv6 protocol, the message 1 can be a BIERv6 message. In this case, the aforementioned check information 1 can be carried in the DoH of the message 1. In one example, the check information 1, checksum 2, information 1 and information 2 in the aforementioned tunnel header can be carried by an extended TLV field in the DoH. For more information about the TLV field, please refer to Figure 3bThe description is not repeated here.

[0096] S102: The communication device 1 sends the message 1.

[0097] S103: The communication device 2 receives the message 1.

[0098] After the communication device 1 obtains the message 1, the communication device 1 can forward the message 1, and the communication device 2 can receive the message 1 sent by the communication device 1.

[0099] S104: The communication device 2 performs integrity verification on the message 1 according to the check information 1.

[0100] After the communication device 2 receives the message 1, the communication device 2 can perform integrity verification on the message 1 according to the check information 1 in the message 1, to determine whether the message payload of the user message 1 is tampered.

[0101] In an implementation manner of the embodiment of the application, the communication device 2 can perform calculation according to the target content 2 in the message 1, to obtain the check information 2, and perform matching verification on the check information 1 and the check information 2. After the matching verification on the check information 1 and the check information 2, the communication device 2 can process the message 1 according to the result of the matching verification.

[0102] The target content 2 includes a checksum value in the message 1, wherein the checksum value in the message 1 can be checksum 1, can be checksum 2, or can be information 3 used to indicate checksum 2. For details, refer to the description of calculating the check information 2 below, which is not described here. In some embodiments, the target content 2 can also include the source IP address of the message 1. In yet some embodiments, if the message 1 is an SRv6 message, the target content 2 can also include the SID list in the SRH of the message 1.

[0103] In an implementation manner of the embodiment of the application, the communication device 2 can first determine the target content 2 used in the hash check, and then perform hash calculation according to the target content 2 by using the key and / or algorithm of the hash algorithm corresponding to the hash check, to obtain the check information 2.

[0104] As described above in S101, in an example, the message 1 can include information 2 in the tunnel header, and the information 2 is used to indicate the target content 2 used in the hash check. For this case, the communication device 2 can determine the target content 2 according to the information 2 in the message 1. Of course, the target content 2 can also be configured on the communication device 2 in a pre-configuration manner, and the communication device 2 can determine the target content 2 used in the hash check according to the configuration information.

[0105] As described in S101 above, in one example, the tunnel header of message 1 can include information 1, which is used to indicate the key and / or algorithm used for the hash calculation. For this case, communication device 2 can determine the key and / or algorithm used for the hash verification according to information 1 in message 1.

[0106] In the embodiments of the present application, communication device 2 can obtain the verification information 2 according to target content 2. In specific implementation, there can be various implementation manners. The following examples introduce several possible implementation manners.

[0107] In one implementation manner, communication device 2 can obtain checksum 1 from user message 1, and calculate the verification information 2 by using checksum 1. The calculation manner of communication device 2 for obtaining the verification information 2 by using checksum 1 is the same as the calculation manner of communication device 1 for obtaining the verification information 1 by using checksum 2, which can be referred to the related description part of S101, and will not be described here. It can be understood that, considering that the edge node of the IP network domain needs to decapsulate message 1 and parse user message 1 for message forwarding, this implementation manner is preferably implemented in the edge node of the IP network domain. The edge node of the IP network domain can be, for example, communication device R4 or communication device R5 shown in the figure. In one example, the edge node of the IP network domain can be the last node indicated by the SID list list of the SRv6 message. Of course, the intermediate node forwarding message 1 in the IP network domain can also use this manner to calculate the verification information 2, but at this time the intermediate node needs to consume additional resources to parse user message 1. Figure 1a

[0108] In one implementation manner, if the tunnel header of message 1 includes information 3, communication device 2 can obtain the verification information 2 according to information 3 in the tunnel header of message 1. For this case, whether it is the intermediate node forwarding message 1 in the IP network domain or the edge node of the IP network domain, it does not need to consume additional resources to parse user message 1.

[0109] In specific implementation, there can be various implementation manners for communication device 2 to obtain the verification information 2 according to information 3.

[0110] ​In one implementation, when the head node tunnel-encapsulates the original user message, it directly encapsulates checksum 2 into the tunnel header of message 1 (i.e., information 3 is checksum 2). Verification information 1 is obtained by performing a keyed hash calculation based on checksum 2. When a communication device that receives message 1 performs a matching verification on verification information 1, it can first obtain information 3 from the tunnel header of message 1, then perform a keyed hash calculation based on the target content 2 indicated by information 3 to obtain verification information 2, and then perform a matching verification on verification information 1 and verification information 2.

[0111] In another implementation, when the head node that performs tunnel encapsulation on the original user message encapsulates the original user message, it encapsulates checksum 2 into the tunnel header of message 1 (i.e., the aforementioned information 3 is checksum 2). Verification information 1 is obtained by performing a key hash calculation based on calculation result 1 mentioned in S101. When the communication device that receives message 1 performs a matching verification on verification information 1, it can first obtain information 3 in the tunnel header of message 1, then perform a first calculation on information 3 to obtain calculation result 1', and perform a key hash calculation based on target content 2 including the calculation result 1' to obtain verification information 2. After obtaining verification information 2, the verification information 1 and verification information 2 are matched and verified.

[0112] In another implementation: when the head node that performs tunnel encapsulation on the original user message encapsulates the original user message, it encapsulates the value obtained by performing the first calculation on checksum2 into the tunnel header of message 1 (that is, information 3 is the value obtained by performing the first calculation on checksum2), and verification information 1 is obtained by performing a key hash calculation based on checksum2. When the communication device that receives message 1 performs a matching verification on verification information 1, it can first obtain information 3 in the tunnel header of message 1, and then perform a second calculation based on the information 3 to obtain checksum2. Then, a key hash calculation is performed based on the target content 2 including the checksum2 to obtain verification information 2, and the verification information 1 and verification information 2 are matched and verified. The second calculation mentioned here can be the inverse operation of the aforementioned first calculation.

[0113] In yet another implementation, the head node that encapsulates the original user packet performs a first calculation on checksum2, and encapsulates the value obtained from the first calculation of checksum2 into the tunnel header of packet 1 (i.e., information 3 is the value obtained from the first calculation of checksum2), and the check information 1 is obtained by performing a key hash calculation based on the calculation result 1. When the communication device receiving packet 1 performs matching verification on the check information 1, it can perform a key hash calculation based on the target content 2 including the information 3 to obtain check information 2, and perform matching verification on the check information 1 and the check information 2.

[0114] In the embodiments of the present application, if the check information 2 is obtained by the checksum1 calculation, if the communication device 2 determines that the check information 1 and the check information 2 are the same after matching verification, it can be determined that the user packet 1 has not been tampered with, i.e., the user packet 1 is the original user packet, and it is further determined that the packet payload of the user packet has not been tampered with. For this case, the communication device 2 can forward the packet 1. If the communication device 1 determines that the check information 1 and the check information 2 are different, it means that the packet payload of the user packet 1 has been tampered with. For this case, the communication device 2 can discard the packet 1, thereby avoiding the illegal packet to continue to be forwarded in the network. In some embodiments, the communication device 2 can also record the non-matching of the check information 1 and the check information 2 and the related information of the packet 1 to a log.

[0115] In the embodiments of the present application, if the check information 2 is calculated according to the information 3 in the tunnel header indicating the checksum 2. If the communication device 2 determines that the check information 1 and the check information 2 are different after the matching check of the check information 1 and the check information 2, it indicates that the source IP address in the tunnel header of the message 1 or other content in the target content 2 such as the SID list is tampered. For this case, the communication device 2 can discard the message 1, thereby avoiding the illegal message to continue to be forwarded in the network. In some embodiments, the communication device 2 can also record the mismatch of the check information 1 and the check information 2 and the related information of the message 1 to the log. If the check information 1 and the check information 2 are the same, it indicates that the source IP address in the tunnel header of the message 1 and other content in the target content 2 are not tampered. However, this cannot indicate that the message payload of the user message 1 is not tampered. Because the information 3 in the tunnel header of the message 1 is used to indicate the checksum 2, and the checksum 2 is the checksum included in the original user message (i.e. the message 2). If the message payload of the user message 1 is not tampered, the checksum 2 indicated by the information 3 in the tunnel header of the message 1 and the checksum 1 in the user message 1 should be the same. In view of this, in the embodiments of the present application, in order to further determine whether the message payload of the user message 1 is tampered, the communication device 2 can compare the checksum 2 indicated by the information 3 in the tunnel header of the message 1 and the checksum 1 in the user message 1, if they are the same, it can be determined that the message payload of the user message 1 is not tampered. For this case, the communication device 2 can forward the message 1. If the checksum 2 indicated by the information 3 in the tunnel header of the message 1 and the checksum 1 in the user message 1 are different, it indicates that the message payload of the user message 1 is possibly tampered, at this time, the communication device 2 can discard the message 1, or record the mismatch of the check information 1 and the check information 2 and the related information of the message 1 to the log.

[0116] It should be noted that, in order to compare the checksum 2 indicated by the information 3 in the tunnel header of the message 1 with the checksum 1 in the user message 1 for the intermediate node forwarding the message 1 in the IP network domain, the user message 1 also needs to be parsed, which will consume additional resources of the intermediate node. Therefore, in the embodiment of the present application, the step of comparing the checksum 2 indicated by the information 3 in the tunnel header of the message 1 with the checksum 1 in the user message 1 is preferably implemented on the edge node of the IP network domain. Of course, if the additional resources consumed by the intermediate node for parsing the user message 1 are not considered, the step can also be implemented on the intermediate node of the IP network domain. It can be understood that, by implementing the step on the intermediate node of the IP network domain, it can be determined whether the message payload of the user message 1 is tampered with when the message 1 passes through the intermediate node, so that the message can be discarded in time when it is determined that the message payload of the user message 1 is tampered with, thereby avoiding the illegal message from continuing to be forwarded in the IP network domain.

[0117] Figure 4 A flowchart of a message processing method provided by an embodiment of the present application. Figure 4 The message processing method 200 shown can be executed by a first communication device. The first communication device can be the communication device 1 in the above embodiment, and is used to execute the steps executed by the communication device 1 in the above method 100. The method 200 can include, for example, the following S201-S202.

[0118] S201: Obtain a first message, the first message being an Internet Protocol (IP) message, the first message including a tunnel header and a user message, the tunnel header including first verification information, the first verification information being obtained by performing a hash calculation on first target content, the first target content including a first checksum of an original user message.

[0119] S202: Send the first message.

[0120] The first message mentioned here can correspond to the message 1 in the method 100; the user message mentioned here can correspond to the user message 1 in the method 100; the first verification information mentioned here can correspond to the verification information 1 in the method 100; the first target content mentioned here can correspond to the target content 1 in the method 100; and the first checksum mentioned here can correspond to the checksum 2 in the method 100.

[0121] In an implementation manner, the tunnel header further includes first information, the first information being used to indicate the first checksum.

[0122] The first information mentioned here can correspond to the information 3 in the method 100.

[0123] In an implementation, the user message further comprises a second checksum of the user message, and the first checksum and the second checksum are the same.

[0124] The second checksum mentioned here can correspond to checksum1 in method 100.

[0125] In an implementation, the user message further comprises a second checksum of the user message, and the first checksum and the second checksum are different.

[0126] In an implementation, the first communication device comprises a head node performing tunnel encapsulation on the original user message.

[0127] In an implementation, the first communication device is an intermediate node in a forwarding path of the first message.

[0128] Figure 5 A flowchart of a message processing method provided by an embodiment of the present application. Figure 5 The message processing method 300 shown can be performed by a second communication device. The second communication device can be the communication device 2 in the above embodiments, and is configured to perform the steps performed by the communication device 2 in the above method 100. The method 300 can comprise, for example, S301-S302.

[0129] S301: receiving a first message, the first message being an Internet Protocol (IP) message, the first IP message comprising a tunnel header and a user message, the tunnel header comprising first check information, the first check information being obtained by hash calculation according to first target content, the first target content comprising a first checksum of an original user message.

[0130] S302: performing integrity verification on the first message according to the first check information.

[0131] The first message mentioned here can correspond to message 1 in method 100; the user message mentioned here can correspond to user message 1 in method 100; the first check information mentioned here can correspond to check information 1 in method 100; the first target content mentioned here can correspond to target content 1 in method 100; and the first checksum mentioned here can correspond to checksum2 in method 100.

[0132] In an implementation, the tunnel header further comprises first information, and the first information is used to indicate the first checksum.

[0133] The first information mentioned here can correspond to information 3 in the above method 100.

[0134] In an implementation manner, the integrity of the first message is verified according to the first check information, including:

[0135] The second check information is obtained by performing hash calculation according to the second target content of the first message.

[0136] The first check information and the second check information are matched and verified.

[0137] The second target content mentioned here can correspond to target content 2 in the method 100; the second check information mentioned here can correspond to check information 2 in the method 100.

[0138] In an implementation manner, the user message includes a second checksum of the user message, and the second target content includes the second checksum.

[0139] The second checksum mentioned here can correspond to checksum 1 in the method 100.

[0140] In an implementation manner, the integrity of the first message is verified according to the first check information, including:

[0141] The first checksum is determined according to the first information.

[0142] The second check information is obtained by performing hash calculation according to the determined first checksum.

[0143] The first check information and the second check information are matched and verified.

[0144] In an implementation manner, the second communication device is an intermediate node or a tail node in a forwarding path of the first message.

[0145] In the above method 200 and method 300:

[0146] In an implementation manner, the first check information is a keyed-Hash Message Authentication Code (HMAC).

[0147] In an implementation manner, the tunnel header includes an extension header, and the extension header includes the first check information.

[0148] In an implementation manner, the tunnel header includes an extended Type-Length-Value (TLV) field, and the extended TLV field includes the first check information.

[0149] In an implementation, the first target content further includes a source IP address of the first packet.

[0150] In an implementation, the tunnel header further includes second information, which is used to indicate a key and / or an algorithm used for the hash calculation.

[0151] The second information mentioned here can correspond to the information 1 in the method 100.

[0152] In an implementation, the tunnel header further includes third information, which indicates target content used for a hash check, the hash check being used for matching verification of the first check information.

[0153] The third information mentioned here can correspond to the information 3 in the method 100.

[0154] In an implementation, the first packet is an Internet Protocol version 6 (IPv6) packet.

[0155] In an implementation, the tunnel header includes a Segment Routing Header (SRH), and the SRH includes the first check information.

[0156] In an implementation, the first target content further includes a Segment Identifier (SID) list in the SRH.

[0157] In an implementation, the first packet is a Bit Index Explicit Replication version 6 (BIERv6) packet.

[0158] In an implementation, the tunnel header includes a Destination Options Header (DoH), and the DoH includes the first check information.

[0159] In an implementation, the first packet is an Internet Protocol version 4 (IPv4) packet.

[0160] For the specific implementation of the above method 200 and the method 300, reference can be made to the description of the method 100 above, which will not be described in detail here.

[0161] In addition, the embodiments of the present application further provide a communication device 600, as shown in Figure 6 . Figure 6 A structural schematic diagram of a communication device provided by the embodiments of the present application. The communication device 600 includes a transceiver unit 601 and a processing unit 602. The communication device 600 can be used to execute the method 100, the method 200 or the method 300 in the above embodiments.

[0162] In one example, the communication apparatus 600 can perform the method 100 in the above embodiments, when the communication apparatus 600 is configured to perform the method 100 in the above embodiments, the communication apparatus 600 corresponds to the communication apparatus 1 in the method 100. The transceiver unit 601 is configured to perform the transceiving operations performed by the communication apparatus 1 in the method 100. The processing unit 602 is configured to perform the operations performed by the communication apparatus 1 in the method 100, except the transceiving operations. For example, the processing unit 602 is configured to generate a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises a check information 1, the check information 1 is obtained by hashing a target content 1, the target content 1 comprises a checksum 2 in the original user packet; the transceiver unit 601 is configured to send the packet 1.

[0163] In one example, the communication apparatus 600 can perform the method 100 in the above embodiments, when the communication apparatus 600 is configured to perform the method 100 in the above embodiments, the communication apparatus 600 corresponds to the communication apparatus 2 in the method 100. The transceiver unit 601 is configured to perform the transceiving operations performed by the communication apparatus 2 in the method 100. The processing unit 602 is configured to perform the operations performed by the communication apparatus 2 in the method 100, except the transceiving operations. For example, the transceiver unit 601 is configured to receive a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises a check information 1, the check information 1 is obtained by hashing a target content 1, the target content 1 comprises a checksum 2 in the original user packet. The processing unit 602 is configured to perform integrity verification on the packet 1 according to the check information 1.

[0164] In one example, the communication apparatus 600 can perform the method 200 in the above embodiments, when the communication apparatus 600 is configured to perform the method 200 in the above embodiments, the communication apparatus 600 corresponds to the first communication apparatus in the method 200. The transceiver unit 601 is configured to perform the transceiving operations performed by the first communication apparatus in the method 200. The processing unit 602 is configured to perform the operations performed by the first communication apparatus in the method 200, except the transceiving operations. For example, the processing unit 602 is configured to obtain a first packet, the first packet is an Internet Protocol (IP) packet, the first packet comprises a tunnel header and a user packet, the tunnel header comprises a first check information, the first check information is obtained by hashing a first target content, the first target content comprises a first checksum in the original user packet; the transceiver unit 601 is configured to send the first packet.

[0165] In one example, the communication device 600 can perform the method 300 in the above embodiments, when the communication device 600 is configured to perform the method 300 in the above embodiments, the communication device 600 corresponds to the second communication device in the method 300. The transceiver unit 601 is configured to perform the transceiving operations performed by the second communication device in the method 300. The processing unit 602 is configured to perform the operations performed by the second communication device in the method 300, except the transceiving operations. For example, the transceiver unit 601 is configured to receive a first packet, the first packet is an Internet Protocol (IP) packet, the first IP packet comprises a tunnel header and a user packet, the tunnel header comprises first check information, the first check information is obtained by performing a hash calculation according to first target content, the first target content comprises a first checksum of an original user packet; the processing unit 602 is configured to perform integrity verification on the first packet according to the first check information.

[0166] In addition, the embodiments of the present application further provide a communication device 700, as shown in Figure 7 Figure 7 The communication device 700 provided by the embodiments of the present application is a structure diagram of a communication device. The communication device 700 comprises a communication interface 701 and a processor 702 connected with the communication interface 701. The communication device 700 can be configured to perform the method 100, the method 200 or the method 300 in the above embodiments.

[0167] In one example, the communication device 700 can perform the method 100 in the above embodiments, when the communication device 700 is configured to perform the method 100 in the above embodiments, the communication device 700 corresponds to the communication device 1 in the method 100. The communication interface 701 is configured to perform the transceiving operations performed by the communication device 1 in the method 100. The processor 702 is configured to perform the operations performed by the communication device 1 in the method 100, except the transceiving operations. For example, the processor 702 is configured to generate a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises check information 1, the check information 1 is obtained by performing a hash calculation according to target content 1, the target content 1 comprises a checksum 2 included in an original user packet; the communication interface 701 is configured to send the packet 1.

[0168] ​In one example, the communication apparatus 700 can perform the method 100 in the above embodiments, when the communication apparatus 700 is configured to perform the method 100 in the above embodiments, the communication apparatus 700 corresponds to the communication apparatus 2 in the method 100. The communication interface 701 is configured to perform the transceiving operations performed by the communication apparatus 2 in the method 100. The processor 702 is configured to perform the operations performed by the communication apparatus 2 in the method 100, except the transceiving operations. For example, the communication interface 701 is configured to receive a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises a verification information 1, the verification information 1 is obtained by hashing a target content 1, the target content 1 comprises a checksum 2 in the original user packet. The processor 702 is configured to perform integrity verification on the packet 1 according to the verification information 1.

[0169] In one example, the communication apparatus 700 can perform the method 200 in the above embodiments, when the communication apparatus 700 is configured to perform the method 200 in the above embodiments, the communication apparatus 700 corresponds to the first communication apparatus in the method 200. The communication interface 701 is configured to perform the transceiving operations performed by the first communication apparatus in the method 200. The processor 702 is configured to perform the operations performed by the first communication apparatus in the method 200, except the transceiving operations. For example, the processor 702 is configured to obtain a first packet, the first packet is an Internet Protocol (IP) packet, the first packet comprises a tunnel header and a user packet, the tunnel header comprises a first verification information, the first verification information is obtained by hashing a first target content, the first target content comprises a first checksum in the original user packet; the communication interface 701 is configured to send the first packet.

[0170] In one example, the communication apparatus 700 can perform the method 300 in the above embodiments, when the communication apparatus 700 is configured to perform the method 300 in the above embodiments, the communication apparatus 700 corresponds to the second communication apparatus in the method 300. The communication interface 701 is configured to perform the transceiving operations performed by the second communication apparatus in the method 300. The processor 702 is configured to perform the operations performed by the second communication apparatus in the method 300, except the transceiving operations. For example, the communication interface 701 is configured to receive a first packet, the first packet is an Internet Protocol (IP) packet, the first IP packet comprises a tunnel header and a user packet, the tunnel header comprises a first verification information, the first verification information is obtained by hashing a first target content, the first target content comprises a first checksum in the original user packet; the processor 702 is configured to perform integrity verification on the first packet according to the first verification information.

[0171] Further, the embodiment of the present application further provides a communication device 800, as shown in Figure 8 Figure 8 A structural schematic diagram of a communication device provided by the embodiment of the present application is shown in

[0172] The communication device 1000 can be used to execute the method 100, the method 200 or the method 300 in the above embodiments.

[0173] As Figure 8 ​As shown, the communication device 800 can include a processor 810, a memory 820 coupled with the processor 810, and a transceiver 830. The transceiver 830 can be, for example, a communication interface, an optical module, etc. The processor 810 can be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP. The processor can also be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The processor 810 can refer to one processor or multiple processors. The memory 820 can include a volatile memory (e.g., a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD)), or a combination thereof. The memory 820 can refer to one memory or multiple memories. In an embodiment, the memory 820 stores computer-readable instructions including a plurality of software modules, such as a sending module 821, a processing module 822, and a receiving module 823. The processor 810 performs operations according to instructions of each software module after executing each software module. In the embodiment, the operation performed by one software module actually refers to the operation performed by the processor 810 according to the instruction of the software module.

[0174] In one example, the communication apparatus 700 can perform the method 100 in the above embodiments, when the communication apparatus 700 is configured to perform the method 100 in the above embodiments, the communication apparatus 700 corresponds to the communication apparatus 1 in the method 100. The transceiver 830 is configured to perform the transceiving operations performed by the communication apparatus 1 in the method 100. The processor 810 is configured to perform the operations performed by the communication apparatus 1 in the method 100 except the transceiving operations. For example, the processor 810 is configured to generate a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises a verification information 1, the verification information 1 is obtained by hashing a target content 1, the target content 1 comprises a checksum 2 in the original user packet; the transceiver 830 is configured to send the packet 1.

[0175] In one example, the communication apparatus 700 can perform the method 100 in the above embodiments, when the communication apparatus 700 is configured to perform the method 100 in the above embodiments, the communication apparatus 700 corresponds to the communication apparatus 2 in the method 100. The transceiver 830 is configured to perform the transceiving operations performed by the communication apparatus 2 in the method 100. The processor 810 is configured to perform the operations performed by the communication apparatus 2 in the method 100 except the transceiving operations. For example, the transceiver 830 is configured to receive a packet 1, the packet 1 comprises a tunnel header and a user packet 1, the user packet 1 comprises a checksum 1 for verifying the user packet 1, the tunnel header comprises a verification information 1, the verification information 1 is obtained by hashing a target content 1, the target content 1 comprises a checksum 2 in the original user packet. The processor 810 is configured to perform integrity verification on the packet 1 according to the verification information 1.

[0176] In one example, the communication apparatus 700 can perform the method 200 in the above embodiments, when the communication apparatus 700 is configured to perform the method 200 in the above embodiments, the communication apparatus 700 corresponds to the first communication apparatus in the method 200. The transceiver 830 is configured to perform the transceiving operations performed by the first communication apparatus in the method 200. The processor 810 is configured to perform the operations performed by the first communication apparatus in the method 200 except the transceiving operations. For example, the processor 810 is configured to obtain a first packet, the first packet is an Internet Protocol (IP) packet, the first packet comprises a tunnel header and a user packet, the tunnel header comprises a first verification information, the first verification information is obtained by hashing a first target content, the first target content comprises a first checksum in the original user packet; the transceiver 830 is configured to send the first packet.

[0177] In one example, the communication device 700 can perform the method 300 in the above embodiments, when the communication device 700 is configured to perform the method 300 in the above embodiments, the communication device 700 corresponds to the second communication device in the method 300. The transceiver 830 is configured to perform the transceiving operations performed by the second communication device in the method 300. The processor 810 is configured to perform the operations performed by the second communication device in the method 300, except the transceiving operations. For example, the transceiver 830 is configured to receive a first packet, the first packet is an Internet Protocol (IP) packet, the first IP packet comprises a tunnel header and a user packet, the tunnel header comprises first check information, the first check information is obtained by performing a hash calculation on first target content, the first target content comprises a first checksum of the original user packet; the processor 810 is configured to perform integrity verification on the first packet according to the first check information.

[0178] The embodiments of the present application further provide a computer readable storage medium, wherein instructions are stored in the computer readable storage medium, and when the instructions are run on a computer, the computer is caused to perform one or more operations in the method in any of the preceding embodiments.

[0179] The embodiments of the present application further provide a computer readable storage medium, wherein instructions are stored in the computer readable storage medium, and when the instructions are run on a computer, the computer is caused to perform one or more operations in the method in any of the preceding embodiments.

[0180] The embodiments of the present application further provide a computer program product, wherein a computer program is stored in the computer program product, and when the computer program is run on a computer, the computer is caused to perform one or more operations in the method in any of the preceding embodiments of the present application. The embodiments of the present application further provide a communication system, which comprises any of the first communication devices and any of the second communication devices in the above embodiments.

[0181] The embodiments of the present application further provide a communication system, which comprises at least one memory and at least one processor, the at least one memory stores instructions, and the at least one processor executes the instructions, so that the communication system performs any one or more operations in the method (for example, the method 100, the method 200 or the method 300) in any of the preceding embodiments of the present application.

[0182] The terms "first", "second", "third", "fourth", and the like in the description and in the claims of the present application, and above, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of these terms herein is to be construed to cover the embodiments of the application whether or not the embodiments are described using the same term. For example, a "first" object can be construed as a desired object of the embodiments or as a "second" object or, conversely, a "second" object can be construed as the desired object or as a "first" object, without departing from the scope of the present application. Furthermore, the terms "comprise", "comprising", "include", "including", and the like, when used in this specification and in the following claims, are intended to specify the presence of stated features, integers, actions, steps, or components, but they do not preclude the presence or addition of one or more other features, integers, actions, steps, components, or groups thereof.

[0183] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0184] In several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic, for example, the division of units is only a logical business division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0185] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0186] In addition, each business unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software business unit.

[0187] If the integrated unit is implemented in the form of a software service unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0188] Those skilled in the art should be aware that, in one or more examples described above, the described services can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the services can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. The computer-readable medium includes computer storage medium and communication medium, wherein the communication medium includes any medium that facilitates the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0189] The above detailed description of the specific embodiments of the present application has further explained the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above is only a specific embodiment of the present application.

[0190] The above, the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of processing a packet, the method comprising: The method is performed by a first communication device, and comprises: obtaining a first packet, the first packet being an Internet Protocol (IP) packet, the first packet comprising a tunnel header and a user packet, the tunnel header comprising first check information, the first check information being obtained by performing a hash calculation on first target content, the first target content comprising a first checksum of an original user packet, the first check information being a keyed-Hash Message Authentication Code (HMAC); sending the first packet.

2. The method of claim 1, wherein, The tunnel header further comprises first information, the first information being used to indicate the first checksum.

3. The method according to claim 1 or 2, characterized in that, The user packet further comprises a second checksum of the user packet, the first checksum being the same as the second checksum.

4. The method according to claim 1 or 2, characterized in that, The user packet further comprises a second checksum of the user packet, the first checksum being different from the second checksum.

5. The method according to any one of claims 1 to 3, characterized in that, The first communication device comprises a head node performing tunnel encapsulation on the original user packet.

6. The method according to any one of claims 1 to 4, characterized in that, The first communication device is an intermediate node in a forwarding path of the first packet.

7. A method of processing a packet, the method comprising: The method is performed by a second communication device, and comprises: receiving a first packet, the first packet being an Internet Protocol (IP) packet, the first packet comprising a tunnel header and a user packet, the tunnel header comprising first check information, the first check information being obtained by performing a hash calculation on first target content, the first target content comprising a first checksum of an original user packet, the first check information being a keyed-Hash Message Authentication Code (HMAC); performing integrity verification on the first packet according to the first check information.

8. The method of claim 7, wherein, The tunnel header further comprises first information, the first information being used to indicate the first checksum.

9. The method according to claim 7 or 8, characterized in that, The performing integrity verification on the first packet according to the first check information comprises: performing a hash calculation on second target content of the first packet to obtain second check information; performing matching verification on the first check information and the second check information.

10. The method of claim 9, wherein, The user packet comprises a second checksum of the user packet, and the second target content comprises the second checksum.

11. The method of claim 8, wherein, The performing integrity verification on the first packet according to the first check information comprises: determining the first checksum according to the first information; performing a hash calculation on the determined first checksum to obtain second check information; performing matching verification on the first check information and the second check information.

12. The method of any of claims 7-11, wherein: the second communication device is an intermediate node or a tail node in a forwarding path of the first packet.

13. The method according to any one of claims 1 to 12, characterized in that, The tunnel header comprises an extension header, and the extension header comprises the first check information.

14. The method according to any one of claims 1 to 13, characterized in that, The tunnel header comprises an extended Type-Length-Value (TLV) field, and the extended TLV field comprises the first check information.

15. The method according to any one of claims 1 to 14, characterized in that, The first target content further comprises a source IP address of the first packet.

16. The method according to any one of claims 1 to 15, characterized in that, The tunnel header further comprises second information, which is used to indicate a key and / or algorithm used for the hash calculation.

17. The method of any one of claims 1-16, wherein, The tunnel header further comprises third information, which indicates target content used when performing a hash check for matching verification of the first check information.

18. The method of any one of claims 1-17, wherein, The first message is an Internet Protocol version 6 (IPv6) message.

19. The method of claim 18, wherein, The tunnel header comprises a Segment Routing Header (SRH), and the SRH comprises the first check information.

20. The method of claim 19, wherein, The first target content further comprises a Segment Identifier (SID) list in the SRH.

21. The method of any one of claims 1-17, wherein, The first message is a Bit-Index Explicit Replication version 6 (BIERv6) message.

22. The method of claim 21, wherein, The tunnel header comprises an extended Destination Options Header (DoH), and the DoH comprises the first check information.

23. The method of any one of claims 1-17, wherein, The first message is an Internet Protocol version 4 (IPv4) message.

24. A first communications device, characterized by: The first communication device comprises a memory and a processor; The memory is configured to store program code; The processor is configured to execute instructions in the program code, so that the first communication device performs the method in any one of claims 1-6 or 13-23.

25. A second communications device, characterized by The second communication device comprises a memory and a processor; The memory is configured to store program code; The processor is configured to execute instructions in the program code, so that the second communication device performs the method in any one of claims 7-23.

26. A computer readable storage medium, characterized in that, The computer-readable storage medium stores instructions, which, when executed on a computer, cause the computer to perform the method in any one of claims 1-23.

27. A communication system, characterized by The first communication device comprises the first communication device in claim 24, and the second communication device comprises the second communication device in claim 25.

28. A communications device, characterized by The first communication device comprises: a processing unit configured to obtain a first message, the first message being an Internet Protocol (IP) message, the first message comprising a tunnel header and a user message, the tunnel header comprising first check information, the first check information being obtained by performing a hash calculation on first target content, the first target content comprising a first checksum of an original user message, and the first check information being a keyed-Hash Message Authentication Code (HMAC); a transceiver configured to send the first message.

29. The communication apparatus according to claim 28, wherein, The tunnel header further comprises first information, which is used to indicate the first checksum.

30. The communication apparatus according to claim 28 or 29, wherein, The user message further comprises a second checksum of the user message, and the first checksum and the second checksum are the same.

31. The communication apparatus according to claim 28 or 29, characterized by The user message further comprises a second checksum of the user message, and the first checksum and the second checksum are different.

32. The communication apparatus according to any one of claims 28-31, wherein, The communication device comprises a head node performing tunnel encapsulation on the original user message.

33. The communication apparatus according to any one of claims 28-31, wherein, The communication device is an intermediate node in a forwarding path of the first message.

34. A communications device, characterized by The first communication device comprises: The transceiving unit is configured to receive a first packet, the first packet being an Internet Protocol (IP) packet, the first packet comprising a tunnel header and a user packet, the tunnel header comprising first check information, the first check information being obtained by performing a hash calculation on first target content, the first target content comprising a first checksum of the original user packet, the first check information being a keyed-Hash Message Authentication Code (HMAC); The processing unit is configured to perform integrity verification on the first packet according to the first check information.

35. The communication apparatus of claim 34, wherein The tunnel header further comprises first information, the first information being used to indicate the first checksum.

36. The communication apparatus according to claim 34 or 35, wherein, The integrity verification on the first packet according to the first check information comprises: performing a hash calculation on second target content of the first packet to obtain second check information; and performing matching verification on the first check information and the second check information.

37. The communication apparatus of claim 36, wherein The user packet comprises a second checksum of the user packet, and the second target content comprises the second checksum.

38. The communication apparatus of claim 35, wherein, The integrity verification on the first packet according to the first check information comprises: determining the first checksum according to the first information; performing a hash calculation on the determined first checksum to obtain second check information; and performing matching verification on the first check information and the second check information.

39. The communication apparatus according to any one of claims 34-38, wherein: the communication apparatus is an intermediate node or a tail node in a forwarding path of the first packet.

40. The apparatus of any one of claims 28-39, wherein, The tunnel header comprises an extension header, and the extension header comprises the first check information.

41. The apparatus of any one of claims 28-40, wherein, The tunnel header comprises an extended Type-Length-Value (TLV) field, and the extended TLV field comprises the first check information.

42. The apparatus of any of claims 28-41, wherein, The first target content further comprises a source IP address of the first packet.

43. The apparatus of any of claims 28-42, wherein, The tunnel header further comprises second information, the second information being used to indicate a key and / or an algorithm used in the hash calculation.

44. The apparatus of any of claims 28-43, wherein, The tunnel header further comprises third information, the third information indicating target content used in a hash check for matching verification on the first check information.

45. The device of any of claims 28-44, wherein, The first packet is an Internet Protocol version 6 (IPv6) packet.

46. The device of claim 45, wherein, The tunnel header comprises a Segment Routing Header (SRH), and the SRH comprises the first check information.

47. The device of claim 46, wherein, The first target content further comprises a Segment Identifier (SID) list in the SRH.

48. The device of any one of claims 28-44, wherein, The first packet is a Bit Index Explicit Replication version 6 (BIERv6) packet.

49. The device of claim 48, wherein, The tunnel header comprises an extended Destination Options Header (DoH), and the DoH comprises the first check information.

50. The device of any one of claims 28-44, wherein, The first packet is an Internet Protocol version 4 (IPv4) packet.

Images