A tunnel transmission method and device based on software defined wide area network

Abstract

The present invention discloses a tunnel transmission method and device based on software defined wide area network, which is applicable to the IPv6-based flat forwarding segment routing SRv6 bearer protocol, including: a source node device receives tunnel configuration information sent by a controller; when the source node device determines that a tenant isolation function is set in the tunnel configuration information, the tenant isolation flag is set in the segment routing header of the SRv6 message and the tenant information is set in the TLV optional field of the segment routing header; the source node device transmits the SRv6 message to the target node device through the tunnel. The present invention enables the SRv6 message to realize the tenant isolation function by setting the tenant isolation flag in the segment routing header of the SRv6 message and setting the tenant information in the TLV optional field of the segment routing header, thereby improving the security of SRv6 message transmission.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a tunnel transmission method and device based on a software defined wide area network. Background Art

[0002] In the prior art, software-defined wide area network in an IPv6 (Internet Protocol Version 6) environment is a method formed by applying SDN (Software Defined Network) technology to a wide area network scenario.

[0003] Furthermore, SRv6 in IPv6 is a SR (segment routing) source routing technology based on the IPv6 data plane. SRv6 records the prefix list of the IPv6 forwarding address through the segment list, and generates a large number of SRv6 paths by combining limited link and node segments, thereby realizing the tunnel forwarding function of IPv6.

[0004] However, the current SRv6 tunnel forwarding function cannot achieve tenant isolation, anti-replay, authentication mechanism and SLA functions, resulting in low security of SRv6 message transmission. Summary of the invention

[0005] The embodiment of the present invention provides a tunnel transmission method and device based on software-defined wide area network, which is used to improve the security of SRv6 message transmission by realizing tenant isolation function, anti-replay function, authentication mechanism function and SLA function of SRv6 message.

[0006] In a first aspect, an embodiment of the present invention provides a tunnel transmission method based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0007] The source node device receives the tunnel configuration information sent by the controller;

[0008] When determining that the tunnel configuration information has a tenant isolation function, the source node device sets a tenant isolation flag in a segment routing header of the SRv6 message and sets tenant information in a TLV optional field of the segment routing header;

[0009] The source node device transmits the SRv6 message to the target node device through a tunnel.

[0010] In the above technical solution, by setting the tenant isolation flag in the segment routing header of the SRv6 message and setting the tenant information in the TLV optional field of the segment routing header, the SRv6 message implements the tenant isolation function, thereby improving the security of SRv6 message transmission.

[0011] Optionally, also include:

[0012] When the source node device determines that the anti-replay function is set in the tunnel configuration information, the anti-replay flag is set in the segment routing header of the SRv6 message and the sending timestamp and time interval information are set in the TLV optional field of the segment routing header; the sending timestamp and the time interval information are used by the target node device to discard the SRv6 message when determining that the SRv6 message is an anti-replay message.

[0013] In the above technical solution, the anti-replay function is realized by setting the anti-replay flag in the segment routing header of the SRv6 message and setting the sending timestamp and time interval information in the TLV optional field of the segment routing header, thereby improving the security of SRv6 message transmission.

[0014] Optionally, also include:

[0015] When the source node device determines that an authentication mechanism function is set in the tunnel configuration information, the authentication mechanism flag is set in the segment routing header of the SRv6 message and the first encryption information for the TLV optional field is set in the HMAC TLV field of the segment routing header; the first encryption information is used by the target node device to authenticate the SRv6 message.

[0016] In the above technical solution, the authentication mechanism function is realized by setting the authentication mechanism flag in the segment routing header of the SRv6 message and setting the first encryption information for the TLV optional field in the HMAC TLV field of the segment routing header, thereby improving the security of SRv6 message transmission.

[0017] Optionally, also include:

[0018] When the source node device determines that a service level flag is set in the tunnel configuration information, the source node device sets service level agreement SLA information in the TLV optional field of the segment routing header; the SLA information is used to provide the SRv6 message with tunnel transmission quality that complies with the SLA information.

[0019] In the above technical solution, by setting the service level agreement SLA information in the TLV optional field of the segment routing header, the SLA function is implemented and the flexibility of SRv6 message transmission is improved.

[0020] Optionally, the tenant information includes tenant instructions and department instructions;

[0021] The tenant information also includes at least one of the following information: an administrative region indication, a country indication, and an operator indication.

[0022] In a second aspect, an embodiment of the present invention provides a tunnel transmission method based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0023] The target node device receives the SRv6 message sent by the source node device;

[0024] The target node device determines that a tenant isolation flag bit and an authentication mechanism flag bit are set in a segment routing header of the SRv6 message, and tenant information and first encryption information are set in a TLV optional field of the segment routing header;

[0025] When the target node device determines that the first encryption information is consistent with the second encryption information, the target node device processes the SRv6 message; the second encryption information is generated by the target node device based on the tunnel configuration information sent by the controller.

[0026] Optionally, also include:

[0027] The target node device determines that an anti-replay flag is set in the segment routing header of the SRv6 message and a sending timestamp and time interval information are set in the TLV optional field of the segment routing header;

[0028] The target node device determines a transmission duration between a receiving timestamp of receiving the SRv6 message and the sending timestamp, and processes the SRv6 message when the transmission duration satisfies the time interval information.

[0029] In a third aspect, an embodiment of the present invention provides a tunnel transmission method based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0030] The controller receives a tenant isolation instruction set by a user;

[0031] The controller generates tunnel configuration information carrying a tenant isolation function based on the tenant isolation indication and sends the tunnel configuration information to the source node device and the target node device respectively.

[0032] Optionally, also include:

[0033] The controller generates tunnel configuration information carrying an anti-replay function and / or an authentication mechanism function based on an anti-replay instruction and / or an authentication mechanism instruction of a user.

[0034] In a fourth aspect, an embodiment of the present invention provides a tunnel transmission device based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0035] A first acquisition module, used to receive tunnel configuration information sent by the controller;

[0036] A first processing module, configured to, when determining that a tenant isolation function is set in the tunnel configuration information, set a tenant isolation flag in a segment routing header of an SRv6 message and set tenant information in a TLV optional field of the segment routing header;

[0037] The SRv6 message is transmitted to the target node device through the tunnel.

[0038] Optionally, the first processing module is further used for:

[0039] When it is determined that an anti-replay function is set in the tunnel configuration information, an anti-replay flag is set in the segment routing header of the SRv6 message and a sending timestamp and time interval information are set in the TLV optional field of the segment routing header; the sending timestamp and the time interval information are used by the target node device to discard the SRv6 message when it is determined that the SRv6 message is an anti-replay message.

[0040] Optionally, the first processing module is further used for:

[0041] When it is determined that an authentication mechanism function is set in the tunnel configuration information, an authentication mechanism flag is set in the segment routing header of the SRv6 message and first encryption information for the TLV optional field is set in the HMAC TLV field of the segment routing header; the first encryption information is used by the target node device to authenticate the SRv6 message.

[0042] Optionally, the first processing module is further used for:

[0043] When it is determined that a service level flag is set in the tunnel configuration information, service level agreement SLA information is set in the TLV optional field of the segment routing header; the SLA information is used to provide the SRv6 message with tunnel transmission quality that complies with the SLA information.

[0044] Optionally, the tenant information includes tenant instructions and department instructions;

[0045] The tenant information also includes at least one of the following information: an administrative region indication, a country indication, and an operator indication.

[0046] In a fifth aspect, an embodiment of the present invention provides a tunnel transmission device based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0047] A second acquisition module is used to receive the SRv6 message sent by the source node device;

[0048] A second processing module is used to determine that a tenant isolation flag bit and an authentication mechanism flag bit are set in the segment routing header of the SRv6 message, and tenant information and first encryption information are set in the TLV optional field of the segment routing header;

[0049] When it is determined that the first encryption information is consistent with the second encryption information, the SRv6 message is processed; the second encryption information is generated by the target node device based on the tunnel configuration information sent by the controller.

[0050] Optionally, the second processing module is further used for:

[0051] Determine that an anti-replay flag is set in the segment routing header of the SRv6 message and that a sending timestamp and time interval information are set in the TLV optional field of the segment routing header;

[0052] Determine a transmission duration between a receiving timestamp of receiving the SRv6 message and the sending timestamp, and process the SRv6 message when the transmission duration satisfies the time interval information.

[0053] In a sixth aspect, an embodiment of the present invention provides a tunnel transmission device based on a software-defined wide area network, which is applicable to a flat forwarding segment routing SRv6 bearer protocol based on IPv6, including:

[0054] A receiving module, used to receive a tenant isolation instruction set by a user;

[0055] A generation module is used to generate tunnel configuration information carrying a tenant isolation function based on the tenant isolation indication and send it to the source node device and the target node device respectively.

[0056] Optionally, the generating module is further used for:

[0057] Based on the anti-replay instruction and / or the authentication mechanism instruction of the user, tunnel configuration information carrying the anti-replay function and / or the authentication mechanism function is generated.

[0058] In a seventh aspect, an embodiment of the present invention further provides a computer device, including:

[0059] A memory for storing program instructions;

[0060] The processor is used to call the program instructions stored in the memory and execute the above-mentioned tunnel transmission method based on software-defined wide area network according to the obtained program.

[0061] In an eighth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned tunnel transmission method based on software-defined wide area network. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1 A schematic diagram of a system architecture provided by an embodiment of the present invention;

[0064] Figure 2 A schematic diagram of a process flow of a tunnel transmission method based on a software defined wide area network provided in an embodiment of the present invention;

[0065] Figure 3 A schematic diagram of an Optional TLV field provided in an embodiment of the present invention;

[0066] Figure 4 A schematic diagram of a process flow of a tunnel transmission method based on a software defined wide area network provided in an embodiment of the present invention;

[0067] Figure 5 A schematic diagram of a process flow of a tunnel transmission method based on a software defined wide area network provided in an embodiment of the present invention;

[0068] Figure 6 A schematic diagram of the structure of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention;

[0069] Figure 7 A schematic diagram of the structure of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention;

[0070] Figure 8 A schematic structural diagram of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0072] In order to better explain the technical solution of the present invention, the terms that may appear are explained below.

[0073] A replay attack is a method of capturing packets received by a normal destination address, and then copying the packet data to deceive the destination address device. The destination address device will receive the fraudulent data packets as normal data packets. If the network device receives a large number of fraudulent data packets, it will discard normal business data packets.

[0074] SD-WAN (Software Defined Wide Area Network) in SDN is a service formed by applying SDN technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services in a wide geographical range. The characteristic of this service is to "cloudify" network control capabilities through software, supporting the opening of network capabilities that can be perceived by applications.

[0075] SD-WAN inherits the idea of ​​"separation of transmission and control" and realizes unified control of each CPE (Customer Premise Equipment) device through a unified central controller. New CPE can automatically connect to the controller through Call Home to download configurations and policies, truly achieving zero-contact rapid activation, and when the configuration is changed, it only needs to be modified once on the controller, and all branch sites are automatically synchronized. Through CPE's deep identification of traffic and probe-based link status detection, the flexibility of traffic routing strategies is improved, and strategies and network quality tracking and dynamic traffic scheduling are achieved.

[0076] Based on the above description, the software-defined wide area network in the IPv6 environment is a method formed by applying SDN technology to the wide area network scenario. SRv6 in IPv6 is an SR source routing technology implemented based on the IPv6 data plane. SRv6 records the prefix list of the IPv6 forwarding address through the segment list, and generates a large number of SRv6 paths by combining limited links and node segments, thereby realizing the tunnel forwarding function of IPv6; specifically, the packet header is shown in Table 1 below.

[0077] Table 1

[0078]

[0079]

[0080] In the above Table 1, the first three rows of information are IPv6 message headers, and the remaining information is the SRH (segment routing header) of the SRv6 message. Among them, "Source Address" is the source node device address, "Destination Address" is the address of the destination node device, and "Segment list" records the prefix column of the IPv6 forwarding address to realize the tunnel forwarding function.

[0081] However, in the prior art, the current SRv6 tunnel forwarding function cannot realize the tenant isolation function, anti-replay function, authentication mechanism function and SLA function, resulting in low security of SRv6 message transmission. Therefore, there is an urgent need for a tunnel transmission method that can improve the security of SRv6 message transmission by realizing the tenant isolation function, anti-replay function, authentication mechanism function and SLA function of SRv6 messages.

[0082] Figure 1 A system architecture applicable to an embodiment of the present invention is exemplarily shown, and the system architecture includes a controller 110 , a source node device 120 , and a target node device 130 .

[0083] Among them, the controller 110 is used to receive indication information set by the user and generate tunnel configuration information, the indication information including tenant isolation indication, anti-replay indication, LSA indication and / or authentication mechanism indication; and then send the tunnel configuration information to the source node device 120 and the target node device 130.

[0084] The source node device 120 is used to receive the tunnel configuration information sent by the controller 110, and according to the tunnel configuration information, set the tenant isolation flag in the segment routing header of the SRv6 message and set the tenant information in the TLV optional field of the segment routing header, set the anti-replay flag in the segment routing header of the SRv6 message and set the sending timestamp and time interval information in the TLV optional field of the segment routing header, set the authentication mechanism flag in the segment routing header of the SRv6 message and set the first encryption information for the TLV optional field in the HMAC TLV field of the segment routing header and / or set the service level agreement SLA information in the TLV optional field of the segment routing header, thereby generating an SRv6 message; and transmit the SRv6 message to the target node device 130 through the tunnel.

[0085] The target node device 130 is used to receive the tunnel configuration information sent by the controller 110 and the SRv6 message sent by the source node device 120, and verify the SRv6 message according to the tunnel configuration information; wherein the source node device 120 and the target node device 130 can be CPE devices, such as routers.

[0086] It should be noted that the above Figure 1 The structure shown is only an example and is not limited to this embodiment of the present invention.

[0087] Based on the above description, Figure 2 A schematic flow chart of a software-defined wide area network-based tunnel transmission method provided in an embodiment of the present invention is exemplarily shown, and the flow chart can be executed by a software-defined wide area network-based tunnel transmission device.

[0088] like Figure 2 As shown in the figure, the process specifically includes:

[0089] Step 210: The source node device receives the tunnel configuration information sent by the controller.

[0090] In the embodiment of the present invention, the controller also sends the tunnel configuration information to the target node device, and the tunnel configuration information is used to instruct the source node device to implement a specific function.

[0091] Step 220: When the source node device determines that the tenant isolation function is set in the tunnel configuration information, it sets the tenant isolation flag in the segment routing header of the SRv6 message and sets the tenant information in the TLV optional field of the segment routing header.

[0092] In the embodiment of the present invention, the TLV optional field is the Optional TLV field in Table 1 above, that is, the field following the last segment listk[n] in the SRH in Table 1 above.

[0093] Step 230: The source node device transmits the SRv6 message to the target node device through a tunnel.

[0094] In step 210, the tunnel configuration information is generated by the controller based on the indication information set by the user; specifically, the controller receives the tenant isolation indication set by the user; based on the tenant isolation indication, generates the tunnel configuration information carrying the tenant isolation function;

[0095] Exemplarily, the indication information further includes an anti-replay indication and / or an authentication mechanism indication, and generates tunnel configuration information carrying an anti-replay function and / or an authentication mechanism function.

[0096] Also exemplarily, the indication information further includes an SLA indication, and generates tunnel configuration information carrying an SLA function.

[0097] For example, 4 bits (bytes) of information are used as indication information, where the value of the 0th byte represents the tenant isolation indication, the value of the 1st byte represents the anti-replay indication, the value of the 2nd byte represents the authentication mechanism indication, and the value of the 3rd byte represents the SLA indication.

[0098] Furthermore, when the value of the 0th byte is 1, it instructs the source node device to add tenant information to realize the tenant isolation function; when the value of the 1st byte is 1, it instructs the source node device to add the sending timestamp and time interval information to realize the anti-replay function; when the value of the 2nd byte is 1, it instructs the source node device to add the first encryption information to realize the authentication mechanism function; when the value of the 3rd byte is 1, it instructs the source node device to add SLA information to realize the SLA function.

[0099] In step 220, the source node device sets flag information according to the tunnel configuration information; the flag information includes a tenant isolation flag, an anti-replay flag, an authentication mechanism flag, and a service level flag.

[0100] Further, when it is determined that a tenant isolation function is set in the tunnel configuration information, a tenant isolation flag is set in the segment routing header of the SRv6 message; when it is determined that an anti-replay function is set in the tunnel configuration information, an anti-replay flag is set in the segment routing header of the SRv6 message; when it is determined that an authentication mechanism function is set in the tunnel configuration information, an authentication mechanism flag is set in the segment routing header of the SRv6 message; when it is determined that a service level flag is set in the tunnel configuration information, a service level flag is set in the segment routing header of the SRv6 message.

[0101] In an implementable manner, the source node device may set a flag bit in any optional field.

[0102] In an embodiment of the present invention, the source node device sets the flag information in the Flags field of the above Table 1; there are 8 bits (bytes) of flags in the Flags field, and 4 bytes are selected to correspond to the tenant isolation flag, anti-replay flag, authentication mechanism flag and service level flag respectively.

[0103] For example, the 0th byte in the Flags field corresponds to the tenant isolation flag, the 1st byte in the Flags field corresponds to the anti-replay flag, the 2nd byte in the Flags field corresponds to the authentication mechanism flag, and the 3rd byte in the Flags field corresponds to the service level flag.

[0104] That is to say, when it is determined that the tenant isolation function is set in the configuration information, the value of the 0th byte in the Flags field is set to 1; when it is determined that the anti-replay function is set in the configuration information, the value of the 1st byte in the Flags field is set to 1; when it is determined that the authentication mechanism function is set in the configuration information, the value of the 2nd byte in the Flags field is set to 1; when it is determined that the service level flag is set in the configuration information, the value of the 3rd byte in the Flags field is set to 1.

[0105] It is equivalent to that when the value of the corresponding bit byte is 1, it represents setting the corresponding information; for example, when the value of the 0th bit byte is 1, the source node device sets the tenant information in the TLV optional field of the segment routing header, which is equivalent to enabling the tenant isolation function; when the value of the 1st bit byte is 1, the source node device sets the sending timestamp and time interval information in the TLV optional field of the segment routing header, which is equivalent to enabling the anti-replay function; when the value of the 2nd bit byte is 1, the source node device sets the first encryption information for the TLV optional field in the HMAC TLV field of the segment routing header, which is equivalent to enabling the tenant isolation function; when the value of the 3rd bit byte is 1, the source node device sets the tenant information in the TLV optional field of the segment routing header, which is equivalent to enabling the tenant isolation function;

[0106] Among them, the TLV optional field is the Optional TLV field in the above Table 1, and 128 bits are selected in the Optional TLV field to set the tenant information, timestamp, time interval information and SLA information; wherein the tenant information includes tenant indication and department indication; the tenant information also includes at least one of the following information: administrative region indication, country indication and operator indication.

[0107] In order to better explain the above technical solution, Figure 3 This is a schematic diagram of an Optional TLV field exemplarily shown in the present invention, such as Figure 3 As shown, it includes tenant indication, department indication, postal code, city indication, operator information, timestamp, time interval and SLA information. Among them, the postal code and city indication represent the country indication and administrative region indication. For example, the city indication can choose whether to distinguish between administrative regions, districts and counties, districts and counties under the jurisdiction of a city, city-level administrative regions, and provincial-level administrative regions.

[0108] It should be noted that the number of bytes occupied by each indication is preset and is not limited here. For example, the tenant indication is 16 bytes, the SLA information is 9 bytes, and so on.

[0109] In an embodiment of the present invention, the first encrypted information is obtained by a preset hash operation of the set information and the preset source information, wherein the preset source information is the address of the target node device, the address of the source node device, and each address in the segmengtlist; the preset hash operation includes a shared key and multiple selected hash algorithms, which are not limited here.

[0110] Specifically, determine the information to be configured in the tunnel configuration information (such as tenant information, timestamp, etc.), obtain the first encrypted information through a preset hash operation based on the information to be configured and the preset source information, and then when it is determined that the value of the authentication mechanism flag is 1, set the first encrypted information in the HMAC TLV field of the above Table 1.

[0111] In the embodiment of the present invention, the information to be configured can be divided into mandatory items and optional items. For example, tenant information is a mandatory item, and timestamp is an optional item, which is not limited here. That is to say, the information to be configured must include tenant information, but the timestamp can be selected by the user, whether to use the timestamp as the information to be configured.

[0112] Regarding SLA information, the SLA information includes line quality and lines of different levels; specifically, the SLA information is divided into the following 4 levels.

[0113] The first level is the optimal path (low latency, short route), which accesses the operator's pop point and is used to carry enterprise-level core services (voice, video, etc. that require high-quality real-time transmission).

[0114] The second level is a suboptimal path (no mandatory requirement for low latency, just reachable as the benchmark), which accesses the operator's pop point and is used to carry important enterprise-level services.

[0115] The third level is an excellent path (low latency, short route), with no access operator pop points, and is used to carry enterprise-level ordinary services or home-level services.

[0116] The fourth quarter is a common path (no mandatory requirement for low latency, which is the benchmark), without access to operator pop points, and is used to carry home services.

[0117] In step 230, the source node device generates an SRv6 message based on the tenant information, timestamp, time interval information, first encryption information and SLA information, and sends the SRv6 message to the target node device, so that the target node device executes the SRv6 message after verifying that the SRv6 message passes.

[0118] In order to better illustrate the target node device verification SRv6 message, Figure 4 The flowchart of a tunnel transmission method based on a software defined wide area network is exemplarily shown in an embodiment of the present invention. Figure 4 As shown, the process includes:

[0119] Step 410: The target node device receives the SRv6 message sent by the source node device.

[0120] In the embodiment of the present invention, the tunnel configuration information is used to instruct the target node device to verify the SRv6 message.

[0121] Step 420: The target node device determines that a tenant isolation flag and an authentication mechanism flag are set in the segment routing header of the SRv6 message, and tenant information and first encryption information are set in the TLV optional field of the segment routing header.

[0122] In the embodiment of the present invention, an anti-replay flag bit and an SLA flag bit are further provided in the segment routing header of the SRv6 message.

[0123] Step 430: When the target node device determines that the first encryption information is consistent with the second encryption information, the target node device processes the SRv6 message.

[0124] In the embodiment of the present invention, the second encrypted information is generated by the target node device based on the tunnel configuration information sent by the controller.

[0125] In step 420, if it is determined that the anti-replay flag is set, the sending timestamp set in the TLV optional field is determined in the SRv6 message; wherein the sending timestamp is recorded in the TLV optional field when the source node device sends the SRv6 message.

[0126] Before verifying the first encryption information, the target node device determines the transmission duration between the receiving timestamp and the sending timestamp of the received SRv6 message, and processes the SRv6 message when the transmission duration satisfies the time interval information.

[0127] For example, according to the receiving timestamp and the sending timestamp, it is determined that the transmission duration of the SRv6 message is 1ms, and the time interval is 2ms. Then, it is determined that the transmission duration of the SRv6 message meets the time interval information, and the SRv6 message is further processed. That is to say, the time interval information is a preset threshold, which can be a value preset based on experience, such as 3ms, 2.5ms, etc., which is not limited here.

[0128] In step 430, the target node device determines the information to be configured (such as tenant information, timestamp, etc.) added by the source node device based on the tunnel configuration information, and combines it with the preset source information (such as the address of the source node device, etc.), and uses the preset hash algorithm corresponding to the source node device to perform a hash operation to obtain a second hash value. If the first encrypted information is consistent with the second encrypted information, it indicates that the SRv6 message has not been tampered with, because the encrypted information contains a timestamp, which prevents the replay of the SRv6 message, thereby determining that the SRv6 message verification has passed.

[0129] In one practicable manner, in order to ensure the accuracy of message transmission between the source node device and the target node device, the controller will also send NTP instructions to the source node device and the target node device to indicate time synchronization of the source node device and the target node device.

[0130] In the embodiment of the present invention, the device corresponding to each address in the segment list can also verify the SRv6 message, which is not limited or elaborated here.

[0131] In order to better explain the technical solution of the present invention, Figure 5 The schematic diagram of a process flow of a tunnel transmission method based on software defined wide area network is shown as an example. Figure 5 As shown, the process is as follows.

[0132] Step 501: Send tunnel configuration information.

[0133] The controller determines the tunnel configuration information according to the indication information set by the user (including flag information, tenant isolation indication, anti-replay indication, authentication mechanism indication and SLA indication), and then sends the tunnel configuration information to the source node device and the target node device respectively.

[0134] Step 502: Determine whether to enable the tenant isolation function.

[0135] Based on the value of the flag bit 0 in the tunnel configuration information, the source node device sets the value of the flag bit 0 in the tunnel configuration information to the Flags field of the SRv6 message SRH, and determines whether to enable the tenant isolation function; if the value of the flag bit 0 is 1, the representation is enabled, and the tenant information (including tenant indication, department indication, administrative area indication, country indication and operator indication, etc.) is added to the Optional TLV field of the SRv6 message SRH; if the value of the flag bit 0 is 0, the representation is not enabled, that is, the tenant information is not added.

[0136] Step 503: Determine whether to enable the anti-replay function.

[0137] Based on the value of the first bit of the flag in the tunnel configuration information, the source node device sets the value of the first bit of the flag in the tunnel configuration information to the Flags field of the SRv6 message SRH, and determines whether to enable the anti-replay function; if the value of the first bit of the flag is 1, the representation is enabled, and the timestamp and time interval information are added to the OptionalTLV field of the SRv6 message SRH; if the value of the first bit of the flag is 0, the representation is not enabled, that is, the timestamp and time interval information are not added.

[0138] Step 504: Determine whether to enable the authentication mechanism function.

[0139] Based on the value of the second bit of the flag in the tunnel configuration information, the source node device sets the value of the second bit of the flag in the tunnel configuration information to the Flags field of the SRv6 message SRH, and determines whether to enable the authentication mechanism function; if the value of the second bit of the flag is 1, the representation is enabled, and the information added in the Optional TLV field (including tenant information, timestamp, and time interval information) is added to the HMAC TLV field; if the value of the second bit of the flag is 0, the representation is not enabled, that is, the information in the Optional TLV field is not added to the HMAC TLV field.

[0140] Step 505: Determine whether to enable the SLA function.

[0141] Based on the value of the third bit of the flag in the tunnel configuration information, the source node device sets the value of the third bit of the flag in the tunnel configuration information to the Flags field of the SRv6 message SRH, and determines whether to enable the SLA function; if the value of the third bit of the flag is 1, the representation is enabled, and the SLA information is added to the Optional TLV field of the SRv6 message SRH; if the value of the third bit of the flag is 0, the representation is not enabled, that is, the SLA information is not added.

[0142] Step 506: Determine the first encryption information.

[0143] The source node device generates first encryption information according to the value in the HMAC TLV field (including preset source information (such as the target node address, each address in the segment list, etc.) and / or the information added in the Optional TLV field (including tenant information, timestamp and time interval information)), and adds the first encryption information to the HMACTLV field of the SRv6 message SRH.

[0144] Step 507: Determine the SRv6 message.

[0145] The source node device encapsulates the message header and service data of the SRv6 message to generate an SRv6 message.

[0146] Step 508: Send an SRv6 message.

[0147] The source node device distinguishes tunnels according to the above tenant information, determines the tunnel transmission quality according to the above SLA information, and then sends the SRv6 message to the target node device based on the distinguished tunnels and tunnel transmission quality, and records the sending timestamp in the Optional TLV field.

[0148] Step 509: Determine whether the time interval information is satisfied.

[0149] The target node device receives the SRv6 message sent by the source node device and records the receiving timestamp of the SRv6 message;

[0150] The target node device decrypts the SRv6 message, obtains the sending timestamp of the SRv6 message, and then determines the transmission duration of the SRv6 message according to the sending timestamp and the receiving timestamp. If the transmission duration is less than the preset time interval information, the SRv6 message is retained; otherwise, the SRv6 message is discarded.

[0151] Step 510: Determine whether the verification condition is met.

[0152] For the SRv6 message that meets the time interval information, the target node device determines the information to be configured of the SRv6 message based on the tunnel configuration information, that is, the information that should be added in the Optional TLV field, and then generates the second encryption information in combination with the preset source information; determines whether the first encryption information is consistent with the second encryption information, and if so, processes the SRv6 message; otherwise, discards the SRv6 message.

[0153] In an embodiment of the present invention, through the tenant isolation function, different tenants, or even different departments within a tenant, establish links through different tunnel isolation methods. Each tunnel is invisible to other tunnels, and the transmission data information within the same tenant is only visible within the tunnel. It also meets the data transmission needs of users between the headquarters and branches, and ensures that the data in the tunnel cannot be detected by other tenants, thereby improving the security of SRv6 message transmission.

[0154] Through the authentication mechanism function, before the tunnel is established, it is confirmed whether the version information of the devices at both ends is compatible, that is, whether the source node device and the target node device are suitable for establishing a tunnel link and whether they are legal devices for establishing the tunnel, thereby ensuring the security of SRv6 message transmission.

[0155] Through the anti-replay function, the timestamp is verified at the target node device, and the forged packet is discarded before receiving it, which saves the resource consumption of the target node device, prevents the reception of forged packets, and improves the security of SRv6 message transmission.

[0156] Through the SLA function, the network quality level is differentiated, and then the tunnel transmission quality is differentiated, so that users with higher network quality requirements can be given priority in scheduling idle lines to meet high quality requirements when the network is congested; under the condition of ensuring the minimum network quality requirements of general users, the SLA function makes flexible changes and customizations to the network requirements of different users. The flexibility of SRv6 message transmission is improved.

[0157] Based on the same technical concept, Figure 6A schematic structural diagram of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention is exemplarily shown, and the device can execute the process of a software-defined wide area network-based tunnel transmission method.

[0158] like Figure 6 As shown, the device specifically includes:

[0159] A first acquisition module 610, configured to receive tunnel configuration information sent by a controller;

[0160] A first processing module 620 is configured to set a tenant isolation flag in a segment routing header of an SRv6 message and set tenant information in a TLV optional field of the segment routing header when it is determined that a tenant isolation function is set in the tunnel configuration information;

[0161] The SRv6 message is transmitted to the target node device through the tunnel.

[0162] Optionally, the first processing module 620 is further used for:

[0163] When it is determined that an anti-replay function is set in the tunnel configuration information, an anti-replay flag is set in the segment routing header of the SRv6 message and a sending timestamp and time interval information are set in the TLV optional field of the segment routing header; the sending timestamp and the time interval information are used by the target node device to discard the SRv6 message when it is determined that the SRv6 message is an anti-replay message.

[0164] Optionally, the first processing module 620 is further used for:

[0165] When it is determined that an authentication mechanism function is set in the tunnel configuration information, an authentication mechanism flag is set in the segment routing header of the SRv6 message and first encryption information for the TLV optional field is set in the HMAC TLV field of the segment routing header; the first encryption information is used by the target node device to authenticate the SRv6 message.

[0166] Optionally, the first processing module 620 is further used for:

[0167] When it is determined that a service level flag is set in the tunnel configuration information, service level agreement SLA information is set in the TLV optional field of the segment routing header; the SLA information is used to provide the SRv6 message with tunnel transmission quality that complies with the SLA information.

[0168] Optionally, the tenant information includes tenant instructions and department instructions;

[0169] The tenant information also includes at least one of the following information: an administrative region indication, a country indication, and an operator indication.

[0170] Based on the same technical concept, Figure 7 A schematic structural diagram of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention is exemplarily shown, and the device can execute the process of a software-defined wide area network-based tunnel transmission method.

[0171] like Figure 7 As shown, the device specifically includes:

[0172] The second acquisition module 710 is used to receive the SRv6 message sent by the source node device;

[0173] The second processing module 720 is used to determine that a tenant isolation flag bit and an authentication mechanism flag bit are set in the segment routing header of the SRv6 message, and tenant information and first encryption information are set in the TLV optional field of the segment routing header;

[0174] When it is determined that the first encryption information is consistent with the second encryption information, the SRv6 message is processed; the second encryption information is generated by the target node device based on the tunnel configuration information sent by the controller.

[0175] Optionally, the second processing module 720 is further used for:

[0176] Determine that an anti-replay flag is set in the segment routing header of the SRv6 message and that a sending timestamp and time interval information are set in the TLV optional field of the segment routing header;

[0177] Determine a transmission duration between a receiving timestamp of receiving the SRv6 message and the sending timestamp, and process the SRv6 message when the transmission duration satisfies the time interval information.

[0178] Based on the same technical concept, Figure 8 A schematic structural diagram of a software-defined wide area network-based tunnel transmission device provided in an embodiment of the present invention is exemplarily shown, and the device can execute the process of a software-defined wide area network-based tunnel transmission method.

[0179] like Figure 8 As shown, the device specifically includes:

[0180] A receiving module 810 is used to receive a tenant isolation instruction set by a user;

[0181] The generation module 820 is used to generate tunnel configuration information carrying the tenant isolation function based on the tenant isolation indication and send it to the source node device and the target node device respectively.

[0182] Optionally, the generating module 820 is further used for:

[0183] Based on the anti-replay instruction and / or the authentication mechanism instruction of the user, tunnel configuration information carrying the anti-replay function and / or the authentication mechanism function is generated.

[0184] Based on the same technical concept, an embodiment of the present invention further provides a computer device, including:

[0185] A memory for storing program instructions;

[0186] The processor is used to call the program instructions stored in the memory and execute the above-mentioned tunnel transmission method based on software-defined wide area network according to the obtained program.

[0187] Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the above-mentioned tunnel transmission method based on software-defined wide area network.

[0188] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0189] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0190] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0191] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0192] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A tunnel transmission method based on software-defined wide area network, characterized in that: Applicable to IPv6-based flat forwarding segment routing SRv6 bearer protocol, the method includes: The source node device receives the tunnel configuration information sent by the controller; When determining that the tunnel configuration information has a tenant isolation function, the source node device sets a tenant isolation flag in a segment routing header of the SRv6 message and sets tenant information in a TLV optional field of the segment routing header; The source node device transmits the SRv6 message to the target node device through a tunnel.

2. The method according to claim 1, characterized in that Also includes: When determining that the tunnel configuration information is provided with an anti-replay function, the source node device sets an anti-replay flag in a segment routing header of the SRv6 message and sets a sending timestamp and time interval information in a TLV optional field of the segment routing header; The sending timestamp and the time interval information are used by the target node device to discard the SRv6 message when determining that the SRv6 message is an anti-replay message.

3. The method according to claim 1 or 2, characterized in that Also includes: When determining that the tunnel configuration information is provided with an authentication mechanism function, the source node device sets an authentication mechanism flag in a segment routing header of the SRv6 message and sets first encryption information for the TLV optional field in an HMAC TLV field of the segment routing header; The first encryption information is used by the target node device to authenticate the SRv6 message.

4. The method according to claim 3, characterized in that Also includes: When the source node device determines that a service level flag is set in the tunnel configuration information, the source node device sets service level agreement SLA information in the TLV optional field of the segment routing header; The SLA information is used to provide the SRv6 message with tunnel transmission quality that complies with the SLA information.

5. The method according to claim 4, characterized in that The tenant information includes tenant instructions and department instructions; The tenant information also includes at least one of the following information: an administrative region indication, a country indication, and an operator indication.

6. A tunnel transmission method based on software-defined wide area network, characterized in that: Applicable to IPv6-based flat forwarding segment routing SRv6 bearer protocol, the method includes: The target node device receives the SRv6 message sent by the source node device; The target node device determines that a tenant isolation flag bit and an authentication mechanism flag bit are set in a segment routing header of the SRv6 message, and tenant information and first encryption information are set in a TLV optional field of the segment routing header; When the target node device determines that the first encryption information is consistent with the second encryption information, the target node device processes the SRv6 message; the second encryption information is generated by the target node device based on the tunnel configuration information sent by the controller.

7. The method according to claim 6, characterized in that Also includes: The target node device determines that an anti-replay flag is set in the segment routing header of the SRv6 message and a sending timestamp and time interval information are set in the TLV optional field of the segment routing header; The target node device determines a transmission duration between a receiving timestamp of receiving the SRv6 message and the sending timestamp, and processes the SRv6 message when the transmission duration satisfies the time interval information.

8. A source node device, characterized in that: Applicable to IPv6-based flat forwarding segment routing SRv6 bearer protocol, including: A first acquisition module, used to receive tunnel configuration information sent by the controller; A first processing module, configured to, when determining that a tenant isolation function is set in the tunnel configuration information, set a tenant isolation flag in a segment routing header of an SRv6 message and set tenant information in a TLV optional field of the segment routing header; The SRv6 message is transmitted to the target node device through the tunnel.

9. A target node device, characterized in that: Applicable to IPv6-based flat forwarding segment routing SRv6 bearer protocol, including: A second acquisition module is used to receive the SRv6 message sent by the source node device; A second processing module is used to determine that a tenant isolation flag bit and an authentication mechanism flag bit are set in the segment routing header of the SRv6 message, and tenant information and first encryption information are set in the TLV optional field of the segment routing header; When it is determined that the first encryption information is consistent with the second encryption information, the SRv6 message is processed; the second encryption information is generated by the target node device based on the tunnel configuration information sent by the controller.

10. A computer device, characterized in that: include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 5 or 6 to 7 according to the obtained program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method according to any one of claims 1 to 5 or 6 to 7.

Images