Message forwarding method, controller and message forwarding system

Abstract

The present disclosure provides a packet forwarding method, a controller and a packet forwarding system, and relates to the field of communication security. The method comprises: in response to a request of a source node in a domain managed by a controller, determining, by the controller, first path information of a packet sent by the source node, the first path information comprising first routing addresses of a plurality of first nodes, the plurality of first nodes comprising an intermediate node and a destination node; performing, by the controller, first processing on the first routing address of each first node to obtain a second routing address, the first processing comprising encryption based on a session key between the controller and a previous hop node of the first node, and the second routing address of at least one first node being different in length from other first nodes; encapsulating, by the controller, second path information comprising the second routing addresses of the plurality of first nodes to obtain a first SRH, the first SRH carrying information representing the length of the second routing address of each first node; and sending, by the controller, the first SRH to the source node, so that the source node forwards the packet according to the first SRH.

Description

Technical Field

[0001] This disclosure relates to the field of communication security, and in particular to a message forwarding method, controller, and message forwarding system. Background Technology

[0002] IPv6 packets carry a Segment Routing Header (SRH) and are forwarded from the source node to the destination node according to the path information encapsulated in the SRH. This makes the path information in the SRH extremely easy to leak, increasing the risk of network topology leakage and thus reducing network security.

[0003] In related technologies, each routing address in the path information of an SRH can be encrypted to improve network security. Summary of the Invention

[0004] In related encryption technologies, a method that does not alter the information length is required to ensure that each encrypted routing address has the same length. The inventors noticed that while encrypting routing addresses improves network security, it reduces the success rate of packet forwarding. Through analysis, the inventors discovered that not all encrypted routing addresses are identical; rather, there are encrypted routing addresses of varying lengths. This prevents nodes forwarding packets from successfully decrypting the routing address of the next-hop node, thus reducing the success rate of packet forwarding.

[0005] To address the aforementioned problems, the present disclosure proposes the following solutions.

[0006] According to one aspect of the present disclosure, a packet forwarding method is provided, comprising: responding to a request from a source node within a domain managed by a controller, the controller determining first path information for the source node to send a packet, the first path information including first routing addresses of a plurality of first nodes within the domain, the plurality of first nodes including at least one intermediate node and a destination node; the controller performing a first processing on the first routing address of each of the plurality of first nodes to obtain a second routing address, the first processing including encryption based on a session key between the controller and the previous hop node of the first node, wherein the length of the second routing address of at least one first node is different from the second routing addresses of the other first nodes; the controller encapsulating the second path information to obtain a first segmented routing header (SRH), the second path information including the second routing addresses of the plurality of first nodes, the first SRH carrying information indicating the length of the second routing address of each first node; and the controller sending the first SRH to the source node so that the source node forwards the packet according to the first SRH.

[0007] In some embodiments, the first process further includes compression prior to encryption.

[0008] In some embodiments, the length of the first routing address of at least one first node after compression is different from the length of the first routing address of other first nodes after compression.

[0009] In some embodiments, the information includes the sequence number of the start and end bits of the second routing address of each first node in the second path information.

[0010] In some embodiments, the method further includes: each of the source node and intermediate nodes deleting the sequence number of the second routing address of the next-hop node from the information of the first SRH before forwarding the packet to the next-hop node.

[0011] In some embodiments, the method further includes: each of the source node and intermediate nodes determining a first routing address of the next-hop node, including: determining a second routing address of the next-hop node from the second path information based on the information carried by the first SRH; performing a second processing on the second routing address of the next-hop node to obtain the first routing address of the next-hop node, wherein the second processing performed by the source node includes decryption based on the session key between the source node and the controller, and decompression after the decryption, and the second processing performed by the intermediate node includes decryption based on the session key between the intermediate node and the controller, and decompression after the decryption; each of the source node and intermediate nodes forwarding a packet to the next-hop node according to the first routing address of the next-hop node, wherein, when the next-hop node is an intermediate node, the forwarded packet carries the first SRH.

[0012] In some embodiments, when the next-hop node is the destination node, the forwarded message does not carry the first SRH.

[0013] In some embodiments, the first SRH also carries a digital signature obtained by encrypting the first digital digest using the controller's private key, the first digital digest being generated by processing the second path information using a hash algorithm; the method further includes: intermediate nodes processing the second path information in the first SRH carried in the message using the hash algorithm to generate a second digital digest; intermediate nodes decrypting the digital signature carried in the first SRH based on the public key corresponding to the private key to obtain the first digital digest; if the first digital digest and the second digital digest are the same, the intermediate nodes determine the first routing address of the next-hop node.

[0014] In some embodiments, the method further includes: if the first digital digest and the second digital digest are different, the intermediate node sends an alarm message to the controller; the controller re-determines the third path information of the message sent by the source node, the third path information including the first routing address of a plurality of second nodes in the domain, the plurality of second nodes including at least one intermediate node and a destination node, and excluding the previous hop intermediate node of the intermediate node that sent the alarm message; the controller uses the plurality of second nodes as the plurality of first nodes and re-executes the first process.

[0015] In some embodiments, the session key between each first node in the domain and the controller is updated periodically.

[0016] According to another aspect of the embodiments of this disclosure, a controller is provided, comprising: a determining module configured to, in response to a request from a source node within a domain managed by the controller, determine first path information for a message sent by the source node, the first path information including first routing addresses of a plurality of first nodes within the domain, the plurality of first nodes including at least one intermediate node and a destination node; a processing module configured to perform a first processing on the first routing address of each of the plurality of first nodes to obtain a second routing address, the first processing including encryption based on a session key between the controller and the previous-hop node of the first node, wherein the length of the second routing address of at least one first node is different from the second routing addresses of the other first nodes; an encapsulation module configured to encapsulate the second path information to obtain a first segmented routing header (SRH), the second path information including the second routing addresses of the plurality of first nodes, the first SRH carrying information indicating the length of the second routing address of each first node; and a sending module configured to send the first SRH to the source node so that the source node forwards the message according to the first SRH.

[0017] According to another aspect of the present disclosure, a controller is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to execute the method described in any of the above embodiments based on instructions stored in the memory.

[0018] According to another aspect of the present disclosure, a message forwarding system is provided, comprising: a controller as described in any of the above embodiments; a source node configured to forward messages according to a first SRH; an intermediate node; and a destination node.

[0019] In some embodiments, the information includes the sequence number of the start and end bits of the second routing address of each first node in the second path information; each of the source node and intermediate nodes is configured to: remove the sequence number of the second routing address of the next hop node from the information of the first SRH before forwarding the packet to the next hop node.

[0020] In some embodiments, the first process further includes compression prior to encryption; each of the source node and intermediate nodes is configured to: determine a first routing address of the next-hop node, including: determining a second routing address of the next-hop node from the second path information based on the information carried by the first SRH; and performing a second process on the second routing address of the next-hop node to obtain the first routing address of the next-hop node, wherein the second process performed by the source node includes decryption based on the session key between the source node and the controller, and decompression after the decryption, and the second process performed by the intermediate node includes decryption based on the session key between the intermediate node and the controller, and decompression after the decryption; forwarding a packet to the next-hop node according to the first routing address of the next-hop node, wherein, when the next-hop node is an intermediate node, the forwarded packet carries the first SRH.

[0021] In some embodiments, the first SRH also carries a digital signature obtained by encrypting the first digital digest using the controller's private key. The first digital digest is generated by processing the second path information using a hash algorithm. The intermediate node is further configured to: process the second path information in the first SRH carried in the message using the hash algorithm to generate a second digital digest; decrypt the digital signature carried in the first SRH based on the public key corresponding to the private key to obtain the first digital digest; and determine the first routing address of the next-hop node if the first digital digest and the second digital digest are the same.

[0022] In some embodiments, the intermediate node is further configured to: send an alarm message to the controller if the first digital digest differs from the second digital digest; the controller is further configured to: re-determine the third path information of the message sent by the source node, the third path information including the first routing addresses of a plurality of second nodes within the domain, the plurality of second nodes including at least one intermediate node and a destination node, and excluding the previous hop intermediate node of the intermediate node that sent the alarm message; and re-execute the first process using the plurality of second nodes as the plurality of first nodes.

[0023] According to another aspect of the present disclosure, a computer-readable storage medium is provided, including computer program instructions, wherein the computer program instructions, when executed by a processor, implement the method described in any of the above embodiments.

[0024] In this embodiment, on the one hand, the second path information carried by the first SRH sent by the controller to the source node includes an encrypted second routing address instead of the first routing address. This reduces the risk of first path information leakage, thereby reducing the risk of network topology leakage and improving network security. On the other hand, the first SRH carries information indicating the length of the second routing address of each first node. Even if the length of the second routing address of at least one first node differs from that of other first nodes, the source node and intermediate nodes forwarding the packet can still decrypt and obtain the routing address of the next-hop node based on the information indicating the length of the second routing address of each first node, thereby improving the success rate of packet forwarding. Thus, both network security and packet forwarding success rate can be balanced.

[0025] The technical solutions of this disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating a message forwarding method according to some embodiments of the present disclosure;

[0028] Figure 2 This is a flowchart illustrating a message forwarding method according to other embodiments of this disclosure;

[0029] Figure 3 This is a schematic diagram of the structure of a controller according to some embodiments of the present disclosure;

[0030] Figure 4 This is a schematic diagram of the structure of a controller according to some embodiments of the present disclosure;

[0031] Figure 5 This is a schematic diagram of the structure of a message forwarding system according to some embodiments of the present disclosure. Detailed Implementation

[0032] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0033] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of this disclosure.

[0034] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0035] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0036] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0037] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0038] Figure 1 This is a flowchart illustrating a message forwarding method according to some embodiments of the present disclosure.

[0039] like Figure 1 As shown, the message forwarding method includes steps 102 to 108.

[0040] In step 102, in response to a request from a source node within the domain managed by the controller, the controller determines the first path information for the message sent by the source node.

[0041] For example, a controller manages multiple SRv6 nodes within a domain. When one of these nodes (i.e., the source node) needs to send an IPv6 packet, it sends a request to the controller. In response to this request, the controller determines the first path information for the source node to send the packet.

[0042] Here, the first path information includes the first route addresses of multiple first nodes within the domain managed by the controller. These multiple first nodes include at least one intermediate node and a destination node.

[0043] It should be understood that, based on the first routing address of the first node, a packet can be accurately routed to that first node. The first routing address of the first node is, for example, a segment ID (SID). The first path information is, for example, a segment list.

[0044] In step 104, the controller performs a first process on the first routing address of each of the multiple first nodes to obtain a second routing address.

[0045] Here, the first process includes encryption based on the session key between the controller and the previous hop node of the first node.

[0046] For example, a controller manages multiple nodes within a domain. The controller can negotiate a key with each node in the domain to obtain a session key between the controller and that node. This reduces the risk of key leakage, thereby improving security.

[0047] In some embodiments, the session key between each node (e.g., the first node) within the domain managed by the controller and the controller is updated periodically. This reduces the risk of key leakage, thereby improving security.

[0048] It should be noted that the length of the second routing address of at least one first node differs from that of the second routing addresses of other first nodes. For example, the length of the first routing address of each first node is 128 bits, while the length of the second routing address of each first node may not be equal to 128 bits.

[0049] It should be understood that this application may employ any suitable encryption algorithm, such as the Data Encryption Standard (DES) algorithm, the Triple Data Encryption (3DES) algorithm, the RC2 algorithm, etc.

[0050] In step 106, the controller encapsulates the second path information to obtain the first SRH. Here, the second path information includes the second routing addresses of multiple first nodes. The first SRH carries information indicating the length of the second routing address of each first node.

[0051] It should be understood that the first SRH also includes information carried by the regular SRH, such as the remaining segment (Segment Left), flag, optional type / length / value object (Optional TLV), etc.

[0052] Information indicating the length of the second route address for each first node can be encapsulated in, for example, the Optional TLV of the first SRH.

[0053] In step 108, the controller sends the first SRH to the source node so that the source node can forward the message according to the first SRH.

[0054] The following text will combine Figure 2 This section describes some implementation methods for the source node to forward packets based on the first SRH.

[0055] In the above embodiments, on the one hand, the second path information carried by the first SRH sent by the controller to the source node includes an encrypted second routing address instead of the first routing address. This reduces the risk of first path information leakage, thereby reducing the risk of network topology leakage and improving network security. On the other hand, the first SRH carries information indicating the length of the second routing address of each first node. Even if the length of the second routing address of at least one first node differs from that of other first nodes, the source node and intermediate nodes forwarding the packet can still decrypt and obtain the routing address of the next-hop node based on the information indicating the length of the second routing address of each first node, thereby improving the success rate of packet forwarding. Thus, both network security and packet forwarding success rate can be balanced.

[0056] As the load of the first SRH carried in the message increases, the message transmission speed decreases. In related technologies, the first routing address of each first node can be compressed to reduce the message load, thereby improving the message transmission speed. The inventors also noted that because the length of the compressed routing address changes significantly, the message forwarding success rate is even lower in this scenario.

[0057] However, because the first SRH carries information indicating the length of the second routing address for each first node, the embodiments of this disclosure can still guarantee the success rate of packet forwarding even in this scenario. Accordingly, this disclosure also proposes the following embodiments that can balance packet transmission speed, network security, and packet forwarding success rate.

[0058] In some embodiments, the first process further includes compression. The controller may perform compression before or after encryption.

[0059] For example, the controller can first compress the first routing address of each first node, and then encrypt the compressed first routing address of the first node based on the session key between the controller and the previous hop node of that first node. In this way, the compression ratio of the first routing address of each first node can be guaranteed, thereby reducing the load of the first SRH carried in the packet and improving the packet transmission speed.

[0060] In some embodiments, the controller performs compression before encryption, and the length of the first routing address of at least one first node after compression is different from the length of the first routing address of the other first nodes after compression.

[0061] It should be understood that here, the first routing address of the first node is first compressed to obtain the compressed first routing address (still called the first routing address), and then the compressed first routing address is encrypted to obtain the second routing address.

[0062] Figure 2This is a flowchart illustrating a message forwarding method according to other embodiments of this disclosure.

[0063] like Figure 2 As shown, in addition to steps 102 to 108, the message forwarding method also includes steps 202 to 208.

[0064] In step 202, the source node determines the first routing address of the next-hop node.

[0065] The source node can determine the first routing address of the next hop node in the following way.

[0066] First, the source node determines the second routing address of the next-hop node from the second path information based on the information carried by the first SRH indicating the length of the second routing address of each first node.

[0067] For example, the second path information of the first SRH includes the second routing addresses of an intermediate node and the destination node. The second routing address of the intermediate node is 40 bits long, and the second routing address of the destination node is 60 bits long. The second routing addresses of each first node are arranged in the second path information according to the order in which the first node forwards the packets. The information carried by the first SRH indicating the length of the second routing address of each first node is, for example, "40:60". The source node can determine the second routing address of the next-hop node from the second path information based on this information.

[0068] Then, the source node performs a second processing on the second routing address of the next-hop node to obtain the first routing address of the next-hop node.

[0069] It should be understood that the second process executed by the source node corresponds to the first process executed by the controller in step 104.

[0070] For example, if the first process includes encryption based on the session key between the controller and the source node, then the second process includes decryption based on the session key between the source node and the controller.

[0071] For example, if the first process includes encryption based on the session key between the controller and the source node, and compression after encryption, then the second process includes decompression, and decryption based on the session key between the source node and the controller after decompression.

[0072] For example, if the first process includes compression and encryption of the compressed data based on the session key between the controller and the source node, then the second process includes decryption based on the session key between the source node and the controller, and decompression of the decrypted data.

[0073] In some embodiments, the Flag carried by the first SRH indicates the type of first process performed by the controller. Upon receiving the first SRH, the corresponding second process can be determined based on the Flag carried by the first SRH. For example, if the controller only encrypts the first routing address of each first node, the Flag carried by the first SRH is "1"; if the controller first compresses and then encrypts the first routing address of each first node, the Flag carried by the first SRH is "2"; and if the controller first encrypts and then compresses the first routing address of each first node, the Flag carried by the first SRH is "3". This allows for accurate determination of the first routing address of the next-hop node, thereby improving the success rate of packet forwarding.

[0074] In step 204, the source node forwards the packet to the next hop node based on the first routing address of the next hop node.

[0075] For example, the source node updates the destination address of the message to the first routing address of the next-hop node and decrements the Segment Left in the first SRH by one. Then, the source node forwards the message carrying the first SRH to the next-hop node.

[0076] Then, the intermediate node receives the message carrying the first SRH and executes steps 206 to 208.

[0077] In step 206, the intermediate node determines the first routing address of the next-hop node.

[0078] Similar to step 202, the intermediate node determines the first routing address of the next-hop node as follows: First, the intermediate node determines the second routing address of the next-hop node from the second path information based on the information representing the length of the second routing address of each first node carried in the first SRH. Then, the intermediate node performs a second processing on the second routing address of the next-hop node to obtain the first routing address of the next-hop node. It should be understood that the intermediate node decrypts the determined second routing address of the next-hop node based on the session key between the intermediate node and the controller.

[0079] In step 208, the intermediate node forwards the packet to the next hop node based on the first routing address of the next hop node.

[0080] It should be understood that step 208 is similar to step 204, and the same parts will not be repeated here.

[0081] In some embodiments, when the next-hop node is still an intermediate node, the forwarded packet carries the first SRH; when the next-hop node is the destination node, the packet forwarded by the intermediate node no longer carries the first SRH. This reduces the load on the packet during forwarding from the last intermediate node to the destination node, thereby increasing the packet transmission speed at this stage. The intermediate node can determine whether the next-hop node is the destination node based on, for example, the Segment Left.

[0082] In the above embodiments, the source node and intermediate nodes perform a second process on the second routing address of the next-hop node determined from the second path information, based on the information indicating the length of the second routing address of each first node carried in the first SRH. Thus, regardless of the length of the second routing address of each first node, the source node and intermediate nodes can accurately determine the first routing address of the next-hop node, thereby improving the success rate of packet forwarding.

[0083] It should be understood that in this embodiment of the disclosure, the source node or intermediate node can only determine the first routing address of the next-hop node, but cannot determine the first routing addresses of all first-hop nodes. In this way, the risk of network topology leakage is extremely low, thereby effectively ensuring network security.

[0084] The following description, in conjunction with some embodiments, further illustrates the point. Figure 2 The message forwarding method shown.

[0085] In some embodiments, the first SRH also carries a digital signature obtained by encrypting the first digital digest using the controller's private key. The first digital digest is generated by processing the second path information using a hash algorithm.

[0086] For example, before encapsulating the second path information, the controller processes the second path information using a hash algorithm to generate a first digital digest. Then, the controller encrypts the first digital digest based on its private key to obtain a digital signature. The digital signature can also be encapsulated in, for example, an optional TLV of the first SRH.

[0087] In the case where the first SRH also carries a digital signature, the intermediate node performs the following operations. First, the intermediate node processes the second path information in the first SRH carried in the message using a hash algorithm to generate a second digital digest. It should be understood that the hash algorithm used by the intermediate node is the same as the hash algorithm used by the controller. Then, the intermediate node decrypts the digital signature carried in the first SRH based on the public key corresponding to the controller's private key to obtain the first digital digest. If the first digital digest and the second digital digest are the same, the intermediate node executes step 206. In this way, it can be ensured that the second path information has not been tampered with, thereby ensuring that the message is forwarded according to the path predetermined by the controller, improving the security of message forwarding.

[0088] It should be understood that after the intermediate node executes step 206, step 208 will be executed automatically.

[0089] In some embodiments, the public key corresponding to the controller's private key is sent to each intermediate node by a third-party Certificate Authority (CA).

[0090] In some embodiments, if the first digital digest differs from the second digital digest, the intermediate node sends an alarm message to the controller. Upon receiving the alarm message from the intermediate node, the controller re-determines the third path information for the message sent by the source node. Similar to the first path information, the third path information includes the first routing addresses of multiple second nodes within the domain managed by the controller. Similar to the multiple first nodes, the multiple second nodes include at least one intermediate node and a destination node. It should be noted that the multiple second nodes do not include the upstream intermediate node of the intermediate node that sent the alarm message. The controller then re-executes step 104, treating the multiple second nodes as multiple first nodes in step 102.

[0091] It should be understood that after the controller executes step 104, it will automatically execute steps 106 and 108.

[0092] It should also be understood that a difference between the first and second digital digests indicates that the second path information has been tampered with. This means that the intermediate node preceding the node sending the alarm may have been subjected to an external attack. The controller re-determines the third path information, excluding that intermediate node. In this way, it can be ensured that the packet is no longer forwarded through the intermediate node that has been subjected to an external attack, thereby improving the security of packet forwarding.

[0093] In some embodiments, the information carried by the first SRH indicating the length of the second routing address of each first node includes the start and end bits of the second routing address of each first node in the sequence number of the second path information. In this way, the source node and intermediate nodes can determine the second routing address of the next-hop node more quickly, thereby determining the first routing address of the next-hop node more quickly and improving packet forwarding speed.

[0094] In this approach, in some embodiments, the source node and intermediate nodes remove two sequence numbers of the second routing address of the next-hop node from the information indicating the length of the second routing address of each first node carried in the first SRH before forwarding the packet to their respective next-hop nodes. This reduces the load of the first SRH carried in the packet, thereby improving the packet transmission speed.

[0095] The following explanation continues, using the example where the second path information of the first SRH includes the second routing addresses of an intermediate node and the destination node, with the intermediate node's second routing address being 40 bits long and the destination node's second routing address being 60 bits long. The first SRH sent by the controller to the source node carries information indicating the length of the second routing address of each first node, for example, "1.40:41.100". After the source node determines the second routing address of the next-hop node, the source node removes the two sequence numbers (i.e., "1.40") of the next-hop node's (i.e., the intermediate node's) second routing address. Then, the first SRH carried by the message sent by the source node to the next-hop node carries the information "41.100".

[0096] In some embodiments, in the information indicating the length of the second routing address of each first node, the two sequence numbers of the second routing address of each first node have the same information length (e.g., the information length of "1.40" and "41.100" is 7 bits each). In this way, the source node and intermediate nodes can determine the second routing address of the next-hop node more quickly, thereby determining the first routing address of the next-hop node more quickly and improving the packet forwarding speed.

[0097] Figure 3 This is a schematic diagram of the structure of a controller according to some embodiments of the present disclosure.

[0098] like Figure 3 As shown, the controller 300 includes a determination module 301, a processing module 302, an encapsulation module 303, and a transmission module 304.

[0099] The determination module 301 is configured to determine first path information for a message sent by a source node in a domain managed by the controller in response to a request from the source node. Here, the first path information includes the first routing addresses of multiple first nodes in the domain managed by the controller, and the multiple first nodes include at least one intermediate node and a destination node.

[0100] Processing module 302 is configured to perform a first process on the first routing address of each of the plurality of first nodes to obtain a second routing address. Here, the first process includes encryption based on a session key between the controller and the previous-hop node of that first node. It should be noted that the length of the second routing address of at least one first node differs from the second routing addresses of the other first nodes.

[0101] Encapsulation module 303 is configured to encapsulate the second path information to obtain a first segmented routing header (SRH). The second path information includes the second routing addresses of multiple first nodes. The first SRH carries information indicating the length of the second routing address of each first node.

[0102] The sending module 304 is configured to send the first SRH to the source node so that the source node can forward the message based on the first SRH.

[0103] Figure 4 This is a schematic diagram of the structure of a controller according to some embodiments of the present disclosure.

[0104] like Figure 4 As shown, the controller 400 includes a memory 401 and a processor 402 coupled to the memory 401. The processor 402 is configured to execute the method of any of the foregoing embodiments based on instructions stored in the memory 401.

[0105] The memory 401 may include, for example, system memory, fixed non-volatile storage media, etc. The system memory may store, for example, an operating system, application programs, a boot loader, and other programs.

[0106] The controller 400 may also include an input / output interface 403, a network interface 404, and a storage interface 405. These interfaces 403, 404, and 405, as well as the memory 401 and processor 402, can be connected via, for example, a bus 406. The input / output interface 403 provides a connection interface for input / output devices such as monitors, mice, keyboards, and touchscreens. The network interface 404 provides a connection interface for various networked devices. The storage interface 405 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0107] Figure 5 This is a schematic diagram of the structure of a message forwarding system according to some embodiments of the present disclosure.

[0108] The message forwarding system includes controller 300 / 400, source node 501, intermediate node 502 and destination node 503.

[0109] Source node 501 is configured to forward packets based on the first SRH.

[0110] It should be understood that a message forwarding system may include one or more intermediate nodes 502 ( Figure 5 (One is shown schematically).

[0111] In some embodiments, the information carried by the first SRH indicating the length of the second routing address of each first node includes the start and end bits of the second routing address of each first node in the sequence number of the second routing address in the second path information. The source node 501 and intermediate node 502 are configured to remove the sequence number of the second routing address of the next-hop node from the information indicating the length of the second routing address of each first node before forwarding the packet to the next-hop node.

[0112] In some embodiments, the first process performed by the controller 300 / 400 includes compression and encryption after compression. The source node 501 (intermediate node 502) is configured to: determine a first routing address for the next-hop node, including: determining a second routing address for the next-hop node from second path information based on information representing the length of a second routing address for each first node carried in a first SRH; and performing a second process on the second routing address of the next-hop node to obtain a first routing address for the next-hop node, the second process including decryption of a session key between the source node 501 (intermediate node 502) and the controller 300 / 400, and decompression after decryption; and forwarding a packet to the next-hop node according to the first routing address of the next-hop node, wherein, if the next-hop node is an intermediate node, the forwarded packet carries the first SRH.

[0113] In some embodiments, the first SRH also carries a digital signature obtained by encrypting the first digital digest using the private key of the controller 300 / 400. The first digital digest is generated by processing the second path information using a hash algorithm. The intermediate node 502 is further configured to: process the second path information in the first SRH carried in the message using a hash algorithm to generate a second digital digest; decrypt the digital signature carried in the first SRH based on the public key corresponding to the private key of the controller 300 / 400 to obtain the first digital digest; and, if the first digital digest and the second digital digest are the same, determine the first routing address of the next-hop node and forward the message to the next-hop node according to the first routing address of the next-hop node.

[0114] In some embodiments, intermediate node 502 is further configured to send an alarm message to controller 300 / 400 if the first digital digest differs from the second digital digest. Controller 300 / 400 is further configured to: re-determine the third path information for the message sent by source node 501, the third path information including the first routing addresses of multiple second nodes within the domain managed by controller 300 / 400, the multiple second nodes including at least one intermediate node 502 and a destination node 503, and excluding the previous hop intermediate node 502 of the intermediate node 502 that sent the alarm message; and re-execute steps 104 to 108, treating the multiple second nodes as multiple first nodes.

[0115] This disclosure also provides a computer-readable storage medium including computer program instructions that, when executed by a processor, implement the method of any of the above embodiments.

[0116] The embodiments of this disclosure have now been described in detail. To avoid obscuring the concept of this disclosure, some details known in the art have not been described. Those skilled in the art can fully understand how to implement the technical solutions disclosed herein based on the above description.

[0117] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus embodiments, since they largely correspond to the method embodiments, the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0118] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that the functions specified in one or more flowchart illustrations and / or one or more blocks in a block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate functions for implementing the functions in the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] While specific embodiments of this disclosure have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments or equivalent substitutions can be made to some technical features without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A message forwarding method, comprising: In response to a request from a source node within a domain managed by the controller, the controller determines first path information for the message sent by the source node. The first path information includes first routing addresses of a plurality of first nodes within the domain, wherein the plurality of first nodes includes at least one intermediate node and a destination node. The controller performs a first process on the first routing address of each of the plurality of first nodes to obtain a second routing address. The first process includes encryption based on a session key between the controller and the previous hop node of the first node, wherein the length of the second routing address of at least one first node is different from the second routing addresses of the other first nodes. The controller encapsulates the second path information to obtain a first segmented routing header (SRH). The second path information includes the second routing addresses of the plurality of first nodes, and the first SRH carries information indicating the length of the second routing address of each first node. The controller sends the first SRH to the source node so that the source node can forward the message based on the first SRH.

2. The method according to claim 1, wherein, The first process also includes compression prior to encryption.

3. The method according to claim 2, wherein, The first routing address of at least one first node has a different compressed length than the first routing addresses of other first nodes.

4. The method according to claim 1, wherein, The information carried by the first SRH includes the sequence number of the start and end bits of the second routing address of each first node in the second path information.

5. The method according to claim 4, further comprising: Before forwarding the message to the next-hop node, each of the source and intermediate nodes removes the sequence number of the second routing address of the next-hop node from the information carried by the first SRH.

6. The method according to claim 2, further comprising: The first routing address for each of the source and intermediate nodes that determines the next-hop node includes: Based on the information carried by the first SRH, the second routing address of the next hop node is determined from the second path information; A second process is performed on the second routing address of the next-hop node to obtain the first routing address of the next-hop node, wherein the second process performed by the source node includes decryption based on the session key between the source node and the controller, and decompression after the decryption, and the second process performed by the intermediate node includes decryption based on the session key between the intermediate node and the controller, and decompression after the decryption; Each of the source node and intermediate nodes forwards the packet to the next-hop node according to the first routing address of the next-hop node. When the next-hop node is an intermediate node, the forwarded packet carries the first SRH.

7. The method according to claim 6, wherein, When the next-hop node is the destination node, the forwarded message does not carry the first SRH.

8. The method according to claim 6, wherein, The first SRH also carries a digital signature obtained by encrypting the first digital digest using the controller's private key. The first digital digest is generated by processing the second path information using a hash algorithm. The method further includes: The intermediate node uses the hash algorithm to process the second path information in the first SRH carried in the message to generate a second digital digest; The intermediate node decrypts the digital signature carried by the first SRH based on the public key corresponding to the private key to obtain the first digital digest; If the first digital digest and the second digital digest are the same, the intermediate node determines the first routing address of the next-hop node.

9. The method according to claim 8, further comprising: If the first digital digest differs from the second digital digest, the intermediate node sends an alarm message to the controller; The controller re-determines the third path information for the message sent by the source node. The third path information includes the first routing address of a plurality of second nodes within the domain. The plurality of second nodes includes at least one intermediate node and a destination node, but does not include the previous hop intermediate node of the intermediate node that sent the alarm information. The controller treats the plurality of second nodes as the plurality of first nodes and re-executes the first process.

10. The method according to any one of claims 1-9, wherein, The session key between each first node in the domain and the controller is updated periodically.

11. A controller, comprising: The determination module is configured to determine first path information of a message sent by the source node in response to a request from a source node within a domain managed by the controller. The first path information includes first routing addresses of a plurality of first nodes within the domain, wherein the plurality of first nodes includes at least one intermediate node and a destination node. The processing module is configured to perform a first processing on a first routing address of each of the plurality of first nodes to obtain a second routing address, the first processing including encryption based on a session key between the controller and the previous hop node of the first node, wherein the length of the second routing address of at least one first node is different from the second routing addresses of the other first nodes. The encapsulation module is configured to encapsulate the second path information to obtain a first segmented routing header (SRH), wherein the second path information includes the second routing addresses of the plurality of first nodes, and the first SRH carries information indicating the length of the second routing address of each first node; The sending module is configured to send the first SRH to the source node so that the source node can forward the message based on the first SRH.

12. A controller, comprising: Memory; and A processor coupled to the memory, the processor being configured to perform the method of any one of claims 1-4 based on instructions stored in the memory.

13. A message forwarding system, comprising: The controller as described in claim 11 or 12; The source node is configured to forward packets based on the first SRH; Intermediate nodes and destination nodes.

14. The system according to claim 13, wherein, The information carried by the first SRH includes the sequence number of the start and end bits of the second routing address of each first node in the second path information; Each of the source node and intermediate nodes is configured to: remove the sequence number of the second routing address of the next-hop node from the information carried by the first SRH before forwarding the packet to the next-hop node.

15. The system according to claim 13, wherein, The first process also includes compression prior to encryption; Each of the source node and intermediate nodes is configured to: determine a first routing address of the next-hop node, including: determining a second routing address of the next-hop node from the second path information based on the information carried by the first SRH; and performing a second process on the second routing address of the next-hop node to obtain the first routing address of the next-hop node, wherein the second process performed by the source node includes decryption based on the session key between the source node and the controller, and decompression after the decryption, and the second process performed by the intermediate node includes decryption based on the session key between the intermediate node and the controller, and decompression after the decryption; and forwarding a packet to the next-hop node according to the first routing address of the next-hop node, wherein, when the next-hop node is an intermediate node, the forwarded packet carries the first SRH.

16. The system according to claim 15, wherein, The first SRH also carries a digital signature obtained by encrypting the first digital digest using the controller's private key. The first digital digest is generated by processing the second path information using a hash algorithm. The intermediate node is also configured to: process the second path information in the first SRH carried in the message using the hash algorithm to generate a second digital digest; decrypt the digital signature carried in the first SRH based on the public key corresponding to the private key to obtain a first digital digest; and determine the first routing address of the next hop node if the first digital digest and the second digital digest are the same.

17. The system according to claim 16, wherein, The intermediate node is also configured to send an alarm message to the controller if the first digital digest differs from the second digital digest. The controller is also configured to: redetermine the third path information for the source node to send the message, the third path information including the first routing address of a plurality of second nodes within the domain, the plurality of second nodes including at least one intermediate node and a destination node, and excluding the previous hop intermediate node of the intermediate node that sent the alarm information; The plurality of second nodes are treated as the plurality of first nodes, and the first process is re-executed.

18. A computer-readable storage medium comprising computer program instructions, wherein, When the computer program instructions are executed by the processor, they implement the method of any one of claims 1-10.

Images