Transmission processing method, device and equipment

Abstract

The present invention provides a transmission processing method, device and equipment, which relate to the field of communication technology. The method is executed by a network device, including: when a received first data packet does not hit the session table and the first channel, but the first data packet hits the security policy, parsing the target address in the first data packet; establishing a second channel according to the target address; when a received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel; wherein the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission. The solution of the present invention solves the problem that SRv6 return traffic cannot pass the state firewall detection.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a transmission processing method, apparatus and device. Background Art

[0002] Firewalls are often used to divide networks into security zones for security protection. By default, firewalls block traffic between security zones. If traffic needs to cross trust zones, security policies must be configured on the firewall to allow it to pass. In some scenarios, to protect the internal network, the firewall allows the internal network to actively access the external network, but not the external network to actively access the internal network. Return traffic from the internal network to the external network is securely forwarded by matching the session table of the stateful firewall.

[0003] In an SRv6 network, when access to the external network needs to cross a firewall, such as when a CPE accesses the Internet through Bras or a terminal accesses the Internet through a 5G network border firewall, the five-tuple information used by the traffic accessing the external network when establishing the session table through the firewall is different from the five-tuple information used by the return traffic when passing through the firewall. As a result, the return traffic cannot match the firewall session and is blocked by the firewall. Summary of the Invention

[0004] The purpose of the present invention is to provide a transmission processing method, device and equipment to solve the problem that return traffic cannot pass the state firewall detection.

[0005] To achieve the above-mentioned object, an embodiment of the present invention provides a transmission processing method, which is executed by a network device and includes:

[0006] If the received first data packet does not match the session table and the first channel, but the first data packet matches the security policy, parsing the destination address in the first data packet;

[0007] Establishing a second channel according to the target address;

[0008] If the received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel;

[0009] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0010] Optionally, parsing the destination address in the first data packet includes:

[0011] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0012] Optionally, establishing the second channel according to the target address includes:

[0013] Determining, based on the node address, a last hop address for transmission of the first data packet;

[0014] A channel between the source address and the last hop address is established as the second channel.

[0015] Optionally, establishing the second channel according to the target address includes:

[0016] According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

[0017] Optionally, establishing the second channel according to the target address includes:

[0018] Searching for a first address according to the field information of the node address;

[0019] A channel between the source address and the first address is established as the second channel.

[0020] Optionally, searching for the first address according to the field information of the node address includes:

[0021] Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0022] The second address is used as the first address.

[0023] Optionally, searching for the first address according to the field information of the node address includes:

[0024] Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0025] acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0026] The fourth address is used as the first address.

[0027] To achieve the above-mentioned object, an embodiment of the present invention provides a network device, comprising: a transceiver and a processor; the processor is configured to:

[0028] If the received first data packet does not match the session table and the first channel, but the first data packet matches the security policy, parsing the destination address in the first data packet;

[0029] Establishing a second channel according to the target address;

[0030] If the received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel;

[0031] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0032] Optionally, the processor is further configured to:

[0033] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0034] Optionally, the processor is further configured to:

[0035] Determining, based on the node address, a last hop address for transmission of the first data packet;

[0036] A channel between the source address and the last hop address is established as the second channel.

[0037] Optionally, the processor is further configured to:

[0038] According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

[0039] Optionally, the processor is further configured to:

[0040] Searching for a first address according to the field information of the node address;

[0041] A channel between the source address and the first address is established as the second channel.

[0042] Optionally, the processor is further configured to:

[0043] Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0044] The second address is used as the first address.

[0045] Optionally, the processor is further configured to:

[0046] Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0047] acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0048] The fourth address is used as the first address.

[0049] To achieve the above objectives, an embodiment of the present invention provides a transmission processing device, including:

[0050] a parsing module, configured to parse a destination address in a received first data packet if the received first data packet does not hit the session table and the first channel but hits the security policy;

[0051] A processing module, configured to establish a second channel according to the target address;

[0052] a transmission module, configured to transmit the second data packet through the second channel if the received second data packet does not hit the session table but the second data packet hits the second channel;

[0053] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0054] Optionally, the parsing module is further configured to:

[0055] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0056] Optionally, the processing module includes:

[0057] A determination submodule, configured to determine the last hop address of the first data packet transmission according to the node address;

[0058] The first processing submodule is configured to establish a channel between the source address and the last hop address as the second channel.

[0059] Optionally, the processing module includes:

[0060] The second processing submodule is configured to establish, according to the source address and the node address, a channel between the source address and each of the node addresses as the second channel.

[0061] Optionally, the processing module includes:

[0062] A search submodule, configured to search for a first address according to field information of the node address;

[0063] The third processing submodule is configured to establish a channel between the source address and the first address as the second channel.

[0064] Optionally, the search submodule includes:

[0065] A first search unit is configured to search for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0066] The first processing unit is configured to use the second address as the first address.

[0067] Optionally, the search submodule includes:

[0068] A second searching unit is configured to search for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0069] a second processing unit, configured to obtain a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0070] The third processing unit is configured to use the fourth address as the first address.

[0071] To achieve the above-mentioned purpose, an embodiment of the present invention provides a network device, including a transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; when the processor executes the program or instruction, the transmission processing method described above is implemented.

[0072] To achieve the above objectives, an embodiment of the present invention provides a readable storage medium having a program or instruction stored thereon, which implements the steps in the above-mentioned transmission processing method when executed by a processor.

[0073] The beneficial effects of the above technical solution of the present invention are as follows:

[0074] The method of an embodiment of the present invention, when a received first data packet does not hit the session table and the first channel, but the first data packet hits the security policy, will parse the target address in the first data packet and establish a second channel based on the target address. Thus, when a received second data packet does not hit the session table, but the second data packet hits the security policy and the second channel, the second data packet is transmitted through the second channel. Here, the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data packet, and the first channel and the second channel are dedicated channels for SRv6 data transmission. In this way, not only can security protection be provided based on the SRv6 address, but the return traffic can also be smoothly transmitted by hitting the dedicated channel for SRv6 data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 This is a flow chart of a transmission processing method according to an embodiment of the present invention;

[0076] Figure 2 This is one of the transmission application diagrams of the method according to the embodiment of the present invention;

[0077] Figure 3 This is the second transmission application diagram of the method according to the embodiment of the present invention;

[0078] Figure 4 This is a diagram of one of the fields of the SRv6 ID;

[0079] Figure 5 This is the third transmission application diagram of the method according to the embodiment of the present invention;

[0080] Figure 6 This is the second diagram of the SRv6 ID field;

[0081] Figure 7 This is the fourth transmission application diagram of the method according to the embodiment of the present invention;

[0082] Figure 8 A structural diagram of a network device according to an embodiment of the present invention;

[0083] Figure 9 for Figure 1 Structural diagram of the device corresponding to the method;

[0084] Figure 10 This is a structural diagram of a network device according to another embodiment of the present invention. DETAILED DESCRIPTION

[0085] In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0086] It should be understood that references throughout this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic associated with the embodiment is included in at least one embodiment of the present invention. Therefore, the appearances of "in one embodiment" or "in an embodiment" throughout this specification do not necessarily refer to the same embodiment. Furthermore, these particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0087] In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0088] Additionally, the terms "system" and "network" are often used interchangeably herein.

[0089] In the embodiments provided herein, it should be understood that "B corresponding to A" means that B is associated with A and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B based solely on A; B can also be determined based on A and / or other information.

[0090] like Figure 1 As shown, a transmission processing method according to an embodiment of the present invention is executed by a network device, including:

[0091] Step 101: if a received first data packet does not match a session table and a first channel, but the first data packet matches a security policy, resolve a destination address in the first data packet;

[0092] Step 102: establishing a second channel according to the target address;

[0093] Step 103: if the received second data packet does not hit the session table but the second data packet hits the second channel, transmit the second data packet through the second channel;

[0094] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0095] According to the above steps, if the first data packet received does not hit the session table and the first channel, but the first data packet hits the security policy, the network device will parse the target address in the first data packet and establish a second channel based on the target address. In this way, if the second data packet received does not hit the session table, but the second data packet hits the second channel, the second data packet will be transmitted through the second channel. Here, the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data packet, and the first channel and the second channel are dedicated channels for SRv6 data transmission. In this way, not only can security protection be provided based on the SRv6 address, but the return traffic can also be smoothly transmitted by hitting the dedicated channel for SRv6 data transmission.

[0096] It should be noted that in this embodiment, the network device establishes a firewall between the internal and external networks. The network device is configured with a session table and security policy to implement secure processing and forwarding. The session table may include a five-tuple of information: source IP address, destination IP address, source port, destination port, and protocol type. Thus, a packet that hits the session table is considered to have hit the session five-tuple. A packet that hits the security policy means that the packet complies with the security policy requirements; a packet that hits the SRv6 data transmission dedicated channel means that the packet's send and receive addresses match the addresses of the SRv6 data transmission dedicated channel.

[0097] Optionally, in this embodiment, for the first received data packet, a query is first performed to determine whether the packet matches the session table. If the query does not match the session table, the query is further performed to determine whether the packet matches the security policy and whether the packet matches the first channel. The query may first determine whether the packet matches the security policy or whether the packet matches the SRv6 data transmission dedicated channel.

[0098] If the first data packet hits the session table, the first data packet will be directly processed and forwarded securely; if the first data does not hit the session table but hits the security policy and the first channel, a session will be established to perform secure processing and forwarding of the first data packet; if the first data does not hit the session table, the security policy, or the first channel, the first data packet will be discarded.

[0099] In addition, after the second channel is established, if the second data packet hits the session table, the second data packet will be directly securely processed and forwarded; if the second data packet does not hit the session table, the security policy and the second channel, the second data packet will be discarded.

[0100] In this embodiment, if the first data packet is the first packet (of forward traffic or reverse traffic), the first data packet does not hit the session table. Reverse traffic may also be referred to as return traffic.

[0101] It should also be known that, in this embodiment, the first data packet is the first packet of the forward traffic, and the second data packet can be a subsequent packet of the forward traffic, the first packet of the reverse traffic, or a subsequent packet of the reverse traffic.

[0102] For example, if the first packet of SRv6 forward traffic does not match the session table and the first channel, but matches the security policy, the destination address in the first SRv6 forward traffic packet is parsed and a second channel is established based on it. A session is then established along the second channel, and other security processing and forwarding are completed. Subsequent packets of SRv6 forward traffic then match the session table and are forwarded. If the first packet of SRv6 reverse traffic does not match the session table, but matches the security policy and the second channel, a session is established along the second channel, and other security processing and forwarding are completed. Subsequent packets of SRv6 reverse traffic then match the session table and are forwarded.

[0103] Optionally, in step 101, parsing the destination address in the first data packet includes:

[0104] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0105] In this way, the establishment of the second channel is achieved based on the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list.

[0106] Optionally, establishing the second channel according to the target address includes:

[0107] Determining, based on the node address, a last hop address for transmission of the first data packet;

[0108] A channel between the source address and the last hop address is established as the second channel.

[0109] Here, the last hop address is the address of the last hop in the SRv6 segment list. Therefore, the second channel established is the channel between the source address and the address of the last hop in the SRv6 segment list.

[0110] For example, Figure 2As shown in the figure, a network device (such as a firewall) parses the first SRv6 forward traffic packet and obtains its source address (node ​​1 address) A1::1 and the last hop address (node ​​3 address) A3::1 in the segment list. Therefore, a channel between A1::1 and A3::1 is established as a dedicated SRv6 data transmission channel. When an SRv6 reverse traffic packet passes through the network device, its source address (node ​​3 address) A3::1 and destination address (node ​​1 address) A1::1 match the established dedicated SRv6 data transmission channel. A session is established for further processing. The SRv6 reverse traffic candidate packet is then directly forwarded within the session.

[0111] Of course, if the destination address of the SRv6 reverse traffic packet is not the SRv6 last hop address but the node2 address, it is necessary to determine whether it hits the established SRv6 data transmission dedicated channel based on the last hop address of the SRv6 reverse traffic packet.

[0112] Optionally, establishing the second channel according to the target address includes:

[0113] According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

[0114] In this way, a channel will be established between the nodes in the SRv6 forwarding path and the source address, allowing the nodes in the SRv6 forwarding path to send reverse traffic to the source node.

[0115] For example, Figure 3As shown in the figure, a network device (such as a firewall) parses the first SRv6 forward traffic packet and obtains its source address (node ​​1's address) A1::1, as well as the node addresses in the segment list: node 2's address A2::1, server 3's address A3::1, and server 4's address A4::1. Therefore, it establishes channels between A1::1 and each node address as dedicated SRv6 data transmission channels: SRv6 data transmission dedicated channel 1 (the channel between A1::1 and A2::1), SRv6 data transmission dedicated channel 2 (the channel between A1::1 and A3::1), and SRv6 data transmission dedicated channel 3 (the channel between A1::1 and A4::1). In this way, when an SRv6 reverse traffic packet from node 2 with source address A2::1 matches the destination address in SRv6 data transmission dedicated channel 1, the destination address A1::1 also matches the source address in SRv6 data transmission dedicated channel 1, thus hitting SRv6 data transmission dedicated channel 1. Subsequently, a session is established and the firewall proceeds to the next step of the processing flow. When the SRv6 reverse traffic packet from Sever3 has source address A3::1 matching the destination address in SRv6 data transmission dedicated channel 2, and ultimately destination address A1::1 matching the source address in SRv6 data transmission dedicated channel 2, the packet hits SRv6 data transmission dedicated channel 2. A session is subsequently established and the firewall proceeds to the next step. When the SRv6 reverse traffic packet from Sever4 has source address A4::1 matching the destination address in SRv6 data transmission dedicated channel 3, the packet finally hits SRv6 data transmission dedicated channel 3, and ultimately destination address A1::1 matching the source address in SRv6 data transmission dedicated channel 3. A session is subsequently established and the firewall proceeds to the next step.

[0116] Optionally, establishing the second channel according to the target address includes:

[0117] Searching for a first address according to the field information of the node address;

[0118] A channel between the source address and the first address is established as the second channel.

[0119] That is, it is necessary to use the field information of the node address to find the first address, and then establish a channel between the source address and the first address.

[0120] In this embodiment, on the one hand, by extending the node address field in the SRv6 segment list, such as the arguments field in the SRv6ID, a first identifier is defined to indicate that the node address carrying the first identifier is the first address. Therefore, optionally, searching for the first address based on the field information of the node address includes:

[0121] Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0122] The second address is used as the first address.

[0123] That is, the node address carrying the first identifier in the search field information, ie, the second address, is used as the first address to establish the SRv6 data transmission dedicated channel.

[0124] like Figure 4 As shown, assuming that the lower 4 bits of the arguments field in the SRv6 ID represent the first identifier, the network device receives the first packet of SRv6 forward traffic, parses the addresses in the SRv6 segment list, and establishes a dedicated SRv6 data transmission channel only for the SRv6 address whose lower 4 bits of the arguments field are "a".

[0125] like Figure 5 As shown in the figure, a network device (such as a firewall) parses the first SRv6 forward traffic packet and obtains its source address (node ​​1's address) A1::1, as well as the node addresses in the segment list: node 2's address A2::1, server 3's address A3::a, and server 4's address A4::a. Therefore, it establishes dedicated SRv6 data transmission channels between A1::1 and server 3's address A3::a and server 4's address A4::a: respectively: SRv6 data transmission dedicated channel 1 (the channel between A1::1 and A3::a) and SRv6 data transmission dedicated channel 2 (the channel between A1::1 and A4::a). In this way, when an SRv6 reverse traffic packet from server 3 with source address A3::a matching the destination address in SRv6 data transmission dedicated channel 1, the destination address A1::1 also matches the source address in SRv6 data transmission dedicated channel 1, thus hitting SRv6 data transmission dedicated channel 1. Subsequently, a session is established and the firewall proceeds to the next step of the processing flow. The SRv6 reverse traffic packet from Sever4 has a source address A4::a that matches the destination address in SRv6 data transmission dedicated channel 2. The final destination address A1::1 matches the source address in SRv6 data transmission dedicated channel 2, and the packet hits SRv6 data transmission dedicated channel 2. Subsequently, a session is established and the process proceeds to the next step of the firewall processing flow.

[0126] In this embodiment, on the other hand, the SRv6 ID in the SRv6 segment list can use the Function field to define the forwarding function in the network. In this way, the SRv6 ID cannot directly represent the device address to establish a channel. Therefore, optionally, searching for the first address based on the field information of the node address includes:

[0127] Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0128] acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0129] The fourth address is used as the first address.

[0130] That is, by searching the field information for the node address carrying the second identifier, i.e., the third address, and then obtaining the fourth address from the target information in the field information of the third address, the fourth address is used as the first address to establish a dedicated SRv6 data transmission channel.

[0131] Here, the second identifier can also be understood as identifying that the current address is to establish a channel based on the Locator; the fourth address is the content of the Locator field in the field information of the third address; and the target information indicates the length of the Locator.

[0132] Assume that Figure 6 As shown, the lower 4 bits of the arguments field, "b," represent the second identifier; the lower 11th through 4th bits of the arguments field represent the destination information. When a network device receives the first packet of SRv6 forward traffic and parses the addresses in the SRv6 segment list, it first identifies the address with "b" in the lower 4 bits of the arguments field. It then uses the lower 11th through 4th bits of the arguments field in that address to determine the length of the Locator. Finally, it uses the contents of the Locator field to derive the fourth address, establishing a dedicated SRv6 data transmission channel.

[0133] like Figure 7As shown, a network device (such as a firewall) parses the first packet of the received SRv6 forward traffic and obtains its source address (node ​​1's address), A1::40b, as well as the node addresses in the segment list: node 2's address, A2::1, and node 3's address, A3::20b. Specifically, since the lower 4 bits of A1::40b are "b," the length "40" yields the locator "A1:: / 64." Similarly, since the lower 4 bits of node 3's address, A3::20b, are "b," the length "20" yields the locator "A3:: / 32." Finally, a channel is established between locators "A1:: / 64" and "A3:: / 32," serving as a dedicated SRv6 data transmission channel. In this way, the source address A3::1 of the first packet of the SRv6 reverse traffic matches the destination address locator "A3:: / 32" in the SRv6 data transmission dedicated channel. The final destination address A1::1 matches the source address locator "A1:: / 64" in the SRv6 data transmission dedicated channel. The established SRv6 data transmission dedicated channel is hit, and a session is established, which enters the next step of the firewall processing flow.

[0134] In summary, when the first data packet received does not hit the session table and the first channel, but the first data packet hits the security policy, the network device will parse the target address in the first data packet and establish a second channel based on the target address. Thus, when the second data packet received does not hit the session table, but the second data packet hits the security policy and the second channel, the second data packet will be transmitted through the second channel. Here, the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data packet, and the first channel and the second channel are dedicated channels for SRv6 data transmission. In this way, not only can security protection be provided based on the SRv6 address, but the return traffic can also be smoothly transmitted by hitting the dedicated channel for SRv6 data transmission.

[0135] like Figure 8 As shown, a network device 800 according to an embodiment of the present invention includes: a transceiver 820 and a processor 810; the processor 810 is configured to:

[0136] If the received first data packet does not match the session table and the first channel, but the first data packet matches the security policy, parsing the destination address in the first data packet;

[0137] Establishing a second channel according to the target address;

[0138] If the received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel;

[0139] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0140] The transceiver 820 is configured to receive a first data packet and a second data packet.

[0141] Optionally, the processor is further configured to:

[0142] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0143] Optionally, the processor is further configured to:

[0144] Determining, based on the node address, a last hop address for transmission of the first data packet;

[0145] A channel between the source address and the last hop address is established as the second channel.

[0146] Optionally, the processor is further configured to:

[0147] According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

[0148] Optionally, the processor is further configured to:

[0149] Searching for a first address according to the field information of the node address;

[0150] A channel between the source address and the first address is established as the second channel.

[0151] Optionally, the processor is further configured to:

[0152] Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0153] The second address is used as the first address.

[0154] Optionally, the processor is further configured to:

[0155] Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0156] acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0157] The fourth address is used as the first address.

[0158] This network device, when a first received data packet does not hit the session table and the first channel, but the first data packet hits the security policy, will parse the target address in the first data packet and establish a second channel based on the target address. Thus, when a second received data packet does not hit the session table, but the second data packet hits the security policy and the second channel, the second data packet will be transmitted through the second channel. Here, the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data packet, and the first channel and the second channel are dedicated channels for SRv6 data transmission. This not only provides security protection based on the SRv6 address, but also allows return traffic to hit the dedicated channel for SRv6 data transmission and be transmitted smoothly.

[0159] It should be noted that the network device is capable of executing the transmission processing method of the above embodiment, and the implementation of the above method embodiment is applicable to the network device and can also achieve the same technical effect.

[0160] like Figure 9 As shown, a transmission processing device according to an embodiment of the present invention includes:

[0161] A parsing module 910 is configured to parse a destination address in a received first data packet when the received first data packet does not match the session table and the first channel, but matches the security policy;

[0162] A processing module 920 is configured to establish a second channel according to the target address;

[0163] a transmission module 930, configured to transmit the second data packet through the second channel if the received second data packet does not hit the session table but the second data packet hits the second channel;

[0164] The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

[0165] Optionally, the parsing module is further configured to:

[0166] Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

[0167] Optionally, the processing module includes:

[0168] A determination submodule, configured to determine the last hop address of the first data packet transmission according to the node address;

[0169] The first processing submodule is configured to establish a channel between the source address and the last hop address as the second channel.

[0170] Optionally, the processing module includes:

[0171] The second processing submodule is configured to establish, according to the source address and the node address, a channel between the source address and each of the node addresses as the second channel.

[0172] Optionally, the processing module includes:

[0173] A search submodule, configured to search for a first address according to field information of the node address;

[0174] The third processing submodule is configured to establish a channel between the source address and the first address as the second channel.

[0175] Optionally, the search submodule includes:

[0176] A first search unit is configured to search for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address;

[0177] The first processing unit is configured to use the second address as the first address.

[0178] Optionally, the search submodule includes:

[0179] A second searching unit is configured to search for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address;

[0180] a second processing unit, configured to obtain a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information;

[0181] The third processing unit is configured to use the fourth address as the first address.

[0182] This device, when a first received data packet does not hit the session table and the first channel, but the first data packet hits the security policy, will parse the target address in the first data packet and establish a second channel based on the target address. Thus, when a second received data packet does not hit the session table, but the second data packet hits the security policy and the second channel, the second data packet will be transmitted through the second channel. Here, the first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data packet, and the first channel and the second channel are dedicated channels for SRv6 data transmission. This not only provides security protection based on the SRv6 address, but also allows return traffic to hit the dedicated channel for SRv6 data transmission and be transmitted smoothly.

[0183] It should be noted that the device can execute the transmission processing method of the above embodiment, and the implementation method of the above method embodiment is applicable to the device and can also achieve the same technical effect.

[0184] A network device according to another embodiment of the present invention, such as Figure 10 As shown, it includes a transceiver 1010, a processor 1000, a memory 1020, and a program or instruction stored in the memory 1020 and executable on the processor 1000; the processor 1000 implements the above-mentioned transmission processing method when executing the program or instruction.

[0185] The transceiver 1010 is configured to receive and send data under the control of the processor 1000 .

[0186] Among them, Figure 10 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1000 and memory represented by memory 1020. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are all well known in the art and, therefore, will not be described further herein. The bus interface provides an interface. The transceiver 1010 may be a plurality of elements, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 1000 is responsible for managing the bus architecture and general processing, and the memory 1020 may store data used by the processor 1000 when performing operations.

[0187] A readable storage medium according to an embodiment of the present invention stores a program or instruction thereon. When the program or instruction is executed by a processor, the steps in the transmission processing method described above are implemented and the same technical effect can be achieved. To avoid repetition, they will not be described here.

[0188] The processor is the processor in the network device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0189] It should be further explained that the network devices described in this specification include but are not limited to gateways, routers, etc., and many of the functional components described are referred to as modules in order to more particularly emphasize the independence of their implementation methods.

[0190] In embodiments of the present invention, modules can be implemented in software so that they can be executed by various types of processors. For example, an identified executable code module can include one or more physical or logical blocks of computer instructions, for example, which can be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different locations, which, when logically combined together, constitute the module and achieve the specified purpose of the module.

[0191] In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed in the middle of different programs, and distributed across a plurality of memory devices.Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form.Described operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

[0192] When a module can be implemented using software, given the current state of hardware technology, those skilled in the art can build corresponding hardware circuits to implement the corresponding functions of the module, regardless of cost. The hardware circuits may include conventional very large scale integration (VLSI) circuits or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules may also be implemented using programmable hardware devices, such as field programmable gate arrays, programmable array logic, or programmable logic devices.

[0193] The above exemplary embodiments are described with reference to the accompanying drawings. Many different forms and embodiments are possible without departing from the spirit and teachings of the present invention. Therefore, the present invention should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be complete and perfect and will convey the scope of the invention to those skilled in the art. In the drawings, component sizes and relative sizes may be exaggerated for clarity. The terminology used herein is for purposes of describing specific exemplary embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include plural forms, unless the context clearly indicates otherwise. It will be further understood that the terms "comprising" and / or "including," when used in this specification, indicate the presence of stated features, integers, steps, operations, components, and / or elements, but do not preclude the presence or addition of one or more other features, integers, steps, operations, components, elements, and / or groups thereof. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of that range and any subranges therebetween.

[0194] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A transmission processing method, characterized in that: Performed by network devices, including: If the received first data packet does not match the session table and the first channel, but the first data packet matches the security policy, parsing the destination address in the first data packet; Establishing a second channel according to the target address; If the received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel; The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

2. The method according to claim 1, characterized in that The parsing of the destination address in the first data packet includes: Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

3. The method according to claim 2, characterized in that The step of establishing a second channel according to the target address includes: Determining, based on the node address, a last hop address for transmission of the first data packet; A channel between the source address and the last hop address is established as the second channel.

4. The method according to claim 2, characterized in that The step of establishing a second channel according to the target address includes: According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

5. The method according to claim 2, characterized in that The step of establishing a second channel according to the target address includes: Searching for a first address according to the field information of the node address; A channel between the source address and the first address is established as the second channel.

6. The method according to claim 5, characterized in that The searching for the first address according to the field information of the node address includes: Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address; The second address is used as the first address.

7. The method according to claim 5, characterized in that The searching for the first address according to the field information of the node address includes: Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address; acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information; The fourth address is used as the first address.

8. A network device, characterized in that: include: transceivers and processors; The processor is configured to: If the received first data packet does not match the session table and the first channel, but the first data packet matches the security policy, parsing the destination address in the first data packet; Establishing a second channel according to the target address; If the received second data packet does not hit the session table, but the second data packet hits the second channel, transmitting the second data packet through the second channel; The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

9. The network device according to claim 8, characterized in that The processor is further configured to: Parse the source address of the SRv6 message in the first data packet and the node address in the SRv6 message segment list to obtain the destination address.

10. The network device according to claim 9, characterized in that The processor is further configured to: Determining, based on the node address, a last hop address for transmission of the first data packet; A channel between the source address and the last hop address is established as the second channel.

11. The network device according to claim 9, wherein: The processor is further configured to: According to the source address and the node address, a channel between the source address and each of the node addresses is established as the second channel.

12. The network device according to claim 9, wherein: The processor is further configured to: Searching for a first address according to the field information of the node address; A channel between the source address and the first address is established as the second channel.

13. The network device according to claim 12, wherein: The processor is further configured to: Searching for a second address carrying a first identifier in the field information, where the first identifier is used to indicate that the current address is an SRv6 data transmission dedicated channel address; The second address is used as the first address.

14. The network device according to claim 12, wherein: The processor is further configured to: Searching for a third address carrying a second identifier in the field information, where the second identifier is used to indicate that the field information carries an SRv6 data transmission dedicated channel address; acquiring a fourth address according to target information in the field information of the third address, wherein the target information is used to indicate a location of the address information carried in the field information; The fourth address is used as the first address.

15. A transmission processing device, characterized in that: include: a parsing module, configured to parse a destination address in a received first data packet if the received first data packet does not hit the session table and the first channel but hits the security policy; A processing module, configured to establish a second channel according to the target address; a transmission module, configured to transmit the second data packet through the second channel if the received second data packet does not hit the session table but the second data packet hits the second channel; The first data packet is an SRv6 data packet, the second data packet is an SRv6 data packet associated with the first data, and the first channel and the second channel are dedicated channels for SRv6 data transmission.

16. A network device comprising: A transceiver, a processor, a memory, and a program or instruction stored in the memory and executable on the processor; wherein the processor implements the transmission processing method according to any one of claims 1 to 7 when executing the program or instruction.

17. A readable storage medium having a program or instruction stored thereon, characterized in that: When the program or instruction is executed by a processor, the steps in the transmission process according to any one of claims 1 to 7 are implemented.

Images