Srv6 protocol forwarding path transmission method and device, equipment and medium

Abstract

This disclosure provides an SRv6 protocol forwarding path transmission method, apparatus, electronic device, and computer-readable storage medium, relating to the fields of network technology and security technology. The method includes: filling an SRv6 data packet with a list of encrypted segments generated corresponding to multiple target forwarding nodes; determining the random key and encryption function parameters corresponding to the target forwarding node, and the encrypted node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node; decrypting the function parameters corresponding to the target forwarding node and the node network address parameters corresponding to the next forwarding node based on a first decryption key and a second decryption key; replacing the filled node network address parameters with the target address, and forwarding the SRv6 data packet to the next forwarding node. This disclosure significantly increases the difficulty for attackers to intercept the complete forwarding path and service processing rules, effectively protecting customized paths from interception and eavesdropping.

Description

Technical Field

[0001] This disclosure relates to the fields of network technology and security technology, and in particular to an SRv6 protocol forwarding path transmission method, apparatus, electronic device and computer-readable storage medium. Background Technology

[0002] The SRv6 (Segment Routing IPv6) protocol provides an efficient and flexible management and control method for the Internet. It features simple deployment and flexible expansion, enabling better traffic scheduling and path optimization, and significantly improving network bandwidth utilization. In many industries, the programmable and customizable transmission path technology of SRv6 can be used to meet business needs. The SRv6 protocol simplifies the network and has good scalability.

[0003] SRv6 instructs forwarding devices to follow a specified forwarding path by inserting an ordered segment list into the SRH header. SRv6 forwards packets through multiple network devices along the path. Currently, DPI (Deep Packet Inspection) devices are widely deployed in network nodes to analyze incoming and outgoing packets. The Segment List in the SRH header clearly marks the packet forwarding path. For certain industries and applications where transmission security is critical, such as finance and logistics, attackers can easily intercept the complete forwarding path and business processing rules. The exposure of customized transmission paths poses a significant risk.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides an SRv6 protocol forwarding path transmission method, apparatus, electronic device, and computer-readable storage medium, which at least to some extent overcomes the risk of transmission paths being vulnerable to attack in related technologies.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, an SRv6 protocol forwarding path transmission method is provided, applied to a target forwarding node, comprising: determining a random key and encryption function parameters corresponding to the target forwarding node, and encryption node network address parameters of the next forwarding node, based on an SRv6 data packet sent by a previous forwarding node; obtaining a first decryption key and a second decryption key based on a first node key, a second node key, and the random key corresponding to the target forwarding node; decrypting the encryption function parameters corresponding to the target forwarding node using the first decryption key to obtain the function parameters corresponding to the target forwarding node; decrypting the encryption node network address parameters corresponding to the next forwarding node using the second decryption key to obtain the node network address parameters corresponding to the next forwarding node; replacing the padded node network address parameters with a target address, and forwarding the SRv6 data packet to the next forwarding node corresponding to the target address.

[0008] In one embodiment of this disclosure, determining the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node based on the SRv6 data packet sent by the previous forwarding node, includes: receiving the SRv6 data packet sent by the previous forwarding node; determining the location data of the target forwarding node based on the SegmentLeft field value of the SRv6 data packet; and determining the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node based on the location data.

[0009] In one embodiment of this disclosure, determining the random key and encryption function parameters corresponding to the target forwarding node and the encryption node network address parameters of the next forwarding node based on the location data includes: determining the random key corresponding to the target forwarding node based on the OptionalTLVs field of the SRv6 data packet and the location data.

[0010] In one embodiment of this disclosure, obtaining the first decryption key and the second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node includes: obtaining the first node key and the second node key based on the node network address parameters corresponding to the target forwarding node; obtaining the first decryption key based on the first node key and the random key; and obtaining the second decryption key based on the second node key and the random key.

[0011] In one embodiment of this disclosure, before determining the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node based on the SRv6 data packet sent by the previous forwarding node, the method further includes: obtaining the random key, the first node key, and the second node key corresponding to the target forwarding node; generating a first encryption key and a second encryption key by combining the random key with the first node key and the second node key; encrypting and generating the encryption node network address parameters corresponding to the next forwarding node based on the second encryption key; and encrypting and generating the encryption function parameters corresponding to the target forwarding node based on the first encryption key.

[0012] In one embodiment of this disclosure, the method further includes: generating an encrypted segment list by taking the network address parameters of multiple encrypted nodes corresponding to multiple target forwarding nodes, the encryption function parameters and the random key, and filling it into the SRv6 data packet.

[0013] In one embodiment of this disclosure, the method further includes: storing multiple random keys corresponding to multiple target forwarding nodes in an Optional TLVs field; and storing multiple first node keys and multiple second node keys corresponding to multiple target forwarding nodes in a key library.

[0014] According to another aspect of this disclosure, an SRv6 protocol forwarding path transmission method is also provided, applied to a configuration node, comprising: obtaining random keys, a first node key, and a second node key corresponding to multiple target forwarding nodes; generating a first encryption key and a second encryption key by combining the random keys with the first node key and the second node key; wherein the first encryption key corresponds to the first decryption key; the second encryption key corresponds to the second decryption key; encrypting and generating encrypted node network address parameters corresponding to the next forwarding node according to the first encryption key; and encrypting and generating encrypted function parameters corresponding to the target forwarding node according to the second encryption key.

[0015] In one embodiment of this disclosure, the method further includes: generating an encrypted segment list by taking the encrypted node network address parameters, the encryption function parameters and the random key corresponding to multiple target forwarding nodes, and filling it into the SRv6 data packet.

[0016] In one embodiment of this disclosure, the method further includes: generating corresponding random keys for multiple target forwarding nodes on the forwarding path according to a random seed key generator; and storing the multiple random keys in the OptionalTLVs field of the SRv6 data packet based on the order of the encrypted segment list.

[0017] In one embodiment of this disclosure, the method further includes storing the first node key and the second node key corresponding to the multiple target forwarding nodes on the forwarding path into a key store.

[0018] According to another aspect of this disclosure, an SRv6 protocol forwarding path transmission apparatus is also provided, comprising:

[0019] The parameter receiving module determines the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node.

[0020] The decryption generation module obtains a first decryption key and a second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node;

[0021] The first decryption module decrypts the encrypted function parameters corresponding to the target forwarding node according to the first decryption key to obtain the function parameters corresponding to the target forwarding node;

[0022] The second decryption module decrypts the encrypted node network address parameters corresponding to the next forwarding node according to the second decryption key to obtain the node network address parameters corresponding to the next forwarding node.

[0023] The forwarding module replaces the filled-in node network address parameters with the target address and forwards the SRv6 data packet to the next forwarding node corresponding to the target address.

[0024] According to another aspect of this disclosure, an SRv6 protocol forwarding path transmission apparatus is also provided, comprising:

[0025] The key acquisition module acquires random keys, first node keys, and second node keys corresponding to multiple target forwarding nodes;

[0026] The encryption generation module generates a first encryption key and a second encryption key by combining the random key with the first node key and the second node key;

[0027] The first encryption module encrypts and generates the encrypted node network address parameters corresponding to the next forwarding node based on the first encryption key.

[0028] The second encryption module encrypts and generates the encryption function parameters corresponding to the target forwarding node based on the second encryption key.

[0029] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above-described SRv6 protocol forwarding path transmission methods by executing the executable instructions.

[0030] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the SRv6 protocol forwarding path transmission method described in any of the preceding claims.

[0031] The SRv6 protocol forwarding path transmission method, apparatus, electronic device, and computer-readable storage medium provided in the embodiments of this disclosure generate an encrypted segment list by generating encrypted node network address parameters, encryption function parameters, and random keys corresponding to multiple target forwarding nodes, and fills it into SRv6 data packets. The target forwarding node determines the random key and encryption function parameters corresponding to the target forwarding node, as well as the encrypted node network address parameters of the next forwarding node, based on the SRv6 data packets sent by the previous forwarding node. A first decryption key and a second decryption key are obtained based on the first node key, the second node key, and the random key corresponding to the target forwarding node. The encryption function parameters corresponding to the target forwarding node are decrypted using the first decryption key to obtain the function parameters corresponding to the target forwarding node. The encrypted node network address parameters corresponding to the next forwarding node are decrypted using the second decryption key to obtain the node network address parameters corresponding to the next forwarding node. The filled node network address parameters are replaced with the target address, and the SRv6 data packets are forwarded to the next forwarding node corresponding to the target address. The SID values ​​in the SegmentList are encrypted collaboratively by two nodes, which significantly increases the difficulty for attackers to intercept the complete forwarding path and business processing rules, effectively protecting customized paths from interception and snooping, and improving business security at the network layer.

[0032] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0034] Figure 1 This diagram illustrates a flowchart of an SRv6 protocol forwarding path transmission method according to an embodiment of the present disclosure.

[0035] Figure 2 This diagram illustrates a flowchart of an encrypted data acquisition method according to an embodiment of the present disclosure;

[0036] Figure 3 This diagram illustrates a flowchart of an SRv6 protocol forwarding path transmission method according to an embodiment of the present disclosure.

[0037] Figure 4 This diagram illustrates a data structure of an SRv6 header field in an embodiment of the present disclosure.

[0038] Figure 5 This diagram illustrates a keystore structure according to an embodiment of the present disclosure.

[0039] Figure 6 This diagram illustrates a flowchart of an encryption processing method for an originating node according to an embodiment of the present disclosure.

[0040] Figure 7 This diagram illustrates an encryption protection method according to an embodiment of the present disclosure.

[0041] Figure 8 This diagram illustrates a flowchart of an encryption method for intermediate and terminal nodes according to an embodiment of the present disclosure.

[0042] Figure 9 This diagram illustrates an SRv6 protocol forwarding path transmission device according to an embodiment of the present disclosure.

[0043] Figure 10 This diagram illustrates an SRv6 protocol forwarding path transmission device according to an embodiment of the present disclosure.

[0044] Figure 11 A schematic diagram of an exemplary system architecture applicable to the SRv6 protocol forwarding path transmission method or SRv6 protocol forwarding path transmission apparatus in embodiments of this disclosure is shown; and

[0045] Figure 12 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0046] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0047] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0048] To facilitate understanding, the following is an explanation of several terms used in this disclosure:

[0049] The SRv6 (Segment Routing IPv6) protocol provides an efficient and flexible management and control method for the Internet. It features simple deployment and flexible expansion, and can better achieve traffic scheduling and path optimization, and significantly improve the utilization of network bandwidth.

[0050] The following detailed description of this exemplary implementation method is provided in conjunction with the accompanying drawings and embodiments.

[0051] First, this disclosure provides an SRv6 protocol forwarding path transmission method, which can be executed by any electronic device with computing power.

[0052] Figure 1 This invention discloses a flowchart of an SRv6 protocol forwarding path transmission method according to an embodiment of the present disclosure, as shown below. Figure 1 As shown in the embodiments of this disclosure, the SRv6 protocol forwarding path transmission method, applied to the target forwarding node, includes the following steps:

[0053] S102, determine the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node.

[0054] In one embodiment, the target forwarding node includes, but is not limited to, originating node, intermediate node, terminating node, configuration node, etc., for configuring and / or forwarding SRv6 packets, etc.

[0055] In one embodiment, the encryption function parameters are the encrypted Function and Args fields; the encryption node network address parameter is the encrypted Locator field.

[0056] In one embodiment, the configuration node defines and encrypts the SRv6 forwarding path according to business needs, as well as the functions and parameters specified by each node, forming a complete encrypted segment list (SegmentList). The encrypted Segment List will be placed in the SRv6 data packet. The configuration node can be an originating node or an intermediate node. Taking the originating node as an example, the originating node obtains the random key, the first node key, and the second node key corresponding to the target forwarding node; it generates a first encryption key and a second encryption key by combining the random key with the first node key and the second node key; it encrypts and generates the encrypted node network address parameters corresponding to the next forwarding node according to the second encryption key; it encrypts and generates the encrypted function parameters corresponding to the target forwarding node according to the first encryption key; and it generates an encrypted segment list by combining the encrypted node network address parameters, encrypted function parameters, and random keys corresponding to multiple target forwarding nodes, and populates it into the SRv6 data packet.

[0057] In one embodiment, the SRv6 data packet sent by the previous forwarding node is received; the location data of the target forwarding node is determined based on the Segment Left field value of the SRv6 data packet; and the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node, are determined based on the location data.

[0058] S104. Obtain the first decryption key and the second decryption key based on the first node key, the second node key and the random key corresponding to the target forwarding node.

[0059] In one embodiment, a first node key and a second node key are obtained based on the node network address parameters corresponding to the target forwarding node; a first decryption key is obtained based on the first node key and a random key; a second decryption key is obtained based on the second node key and a random key; specifically, the first decryption key is obtained by performing an XOR operation on the first node key and the random key; and the second decryption key is obtained by performing an XOR operation on the second node key and the random key.

[0060] In one embodiment, the first node key and the second node key are obtained from the key store based on the node network address parameter corresponding to the target forwarding node.

[0061] In one embodiment, each target forwarding node receives a first node key and a second node key corresponding to the target forwarding node sent by the originating node.

[0062] It should be noted that the first node keys of multiple target forwarding nodes can be the same or different, the second node keys of multiple target forwarding nodes can be the same or different, and the first node key and the second node key of each target forwarding node can be the same or different.

[0063] S106, decrypt the encrypted function parameters corresponding to the target forwarding node according to the first decryption key to obtain the function parameters corresponding to the target forwarding node.

[0064] S108, decrypt the encrypted node network address parameters corresponding to the next forwarding node according to the second decryption key to obtain the node network address parameters corresponding to the next forwarding node.

[0065] In one embodiment, the 128-EEA3 sequence algorithm from the Zu Chongzhi algorithm of the Chinese cryptographic system is applied to encrypt and decrypt information. This algorithm belongs to stream cipher technology, and the encrypted ciphertext has the same length as the original text.

[0066] S110, replace the filled node network address parameter with the target address, and forward the SRv6 packet to the next forwarding node corresponding to the target address.

[0067] In one embodiment, according to the SRv6 protocol, when an SRv6 packet is forwarded to the next forwarding node, the SID value of the next forwarding node is extracted from the Segment List in the SRH packet header of each forwarding node and decrypted. The decrypted Locator value is then filled with a 64-bit random value to make a 128-bit SID. This SID is then used to replace the destination address in the IPv6 packet header. That is, before forwarding, the Locator value of the next forwarding node is extracted and placed in the destination address in the IPv6 packet header. The Function and Args fields can be empty or random numbers. The Segment Left value is decremented by 1. After the operation is completed, the SRv6 packet is forwarded.

[0068] In the above embodiments, based on the SRv6 protocol framework, the SID value in the Segment List in the SRH is encrypted and protected using pre-configured node keys. Two node keys and a random key are used to encrypt and protect the Locator value, Function, and Args of the forwarding path, respectively. Furthermore, each SID is encrypted and decrypted collaboratively by two forwarding nodes. This significantly increases the difficulty for attackers to intercept the complete forwarding path and service processing rules, effectively protecting customized paths from being intercepted and spied on, and improving service security at the network layer.

[0069] Figure 2 This diagram illustrates a flowchart of an encrypted data acquisition method according to an embodiment of the present disclosure, as follows: Figure 2 As shown in the embodiments of this disclosure, the encrypted data acquisition method is applied to a target forwarding node and includes the following steps:

[0070] S202, Receive SRv6 data packets sent by the previous forwarding node.

[0071] S204. Determine the location data of the target forwarding node based on the Segment Left field value of the SRv6 data packet.

[0072] S206, Based on the location data, determine the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node.

[0073] In one embodiment, the random key corresponding to the target forwarding node is determined based on the Optional TLVs field of the SRv6 packet and the location data; for example, based on the Segment Left field value of the SRv6 packet, the Optional TLVs field is searched to determine that the target forwarding node is the third forwarding node, and then the random key and encryption function parameters corresponding to the third forwarding node, as well as the encryption node network address parameters of the fourth forwarding node, are determined.

[0074] In the above embodiments, the Optional TLVs field is searched based on the Segment Left field value of the SRv6 data packet to determine the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node. This can efficiently obtain encrypted data, and the difficulty for attackers to intercept the complete forwarding path and business processing rules is increased exponentially, thereby improving the security of the business from the network layer.

[0075] Figure 3 This invention discloses a flowchart of an SRv6 protocol forwarding path transmission method according to an embodiment of the present disclosure, as shown below. Figure 3 As shown in the embodiments of this disclosure, the SRv6 protocol forwarding path transmission method, applied to a configuration node, includes the following steps:

[0076] S302, obtain the random key, first node key and second node key corresponding to multiple target forwarding nodes.

[0077] In one embodiment, the configuration node can be the originating node.

[0078] S304, generate a first encryption key and a second encryption key by combining the random key with the first node key and the second node key; wherein, the first encryption key corresponds to the first decryption key; and the second encryption key corresponds to the second decryption key.

[0079] In one embodiment, the first encryption key is obtained by XORing the random key with the first node key; the second encryption key is obtained by XORing the random key with the second node key.

[0080] S306, encrypt and generate the encrypted node network address parameters corresponding to the next forwarding node based on the first encryption key.

[0081] It should be noted that the Locator field of the next forwarding node corresponding to the originating node does not need to be encrypted, because the originating node will place the Locator as the destination address in the IPv6 packet header.

[0082] S308, encrypt and generate the encryption function parameters corresponding to the target forwarding node according to the second encryption key.

[0083] In one embodiment, the 128-EEA3 sequence algorithm from the Zu Chongzhi algorithm of the Chinese cryptographic system is applied to encrypt and decrypt information. This algorithm belongs to stream cipher technology, and the encrypted ciphertext has the same length as the original text.

[0084] S310 generates an encrypted segment list by taking the network address parameters, encryption function parameters and random keys of multiple encrypted nodes corresponding to multiple target forwarding nodes, and fills it into the SRv6 data packet.

[0085] Figure 4 This diagram illustrates an SRv6 header field data structure according to an embodiment of the present disclosure. The SRv6 packet header is the original IPv6 header with an added SRH header, such as... Figure 4 As shown:

[0086] The packet begins with the IPv6 header, followed by the SRH header (SR header) and data payload. The Segment List field in the SRH header contains a series of SIDs, which define each forwarding device in the IPv6 packet's forwarding path. In a normal SRv6 packet, all SIDs in the Segment List are in plaintext. Each time a packet passes through a forwarding node, that node extracts the next SID from the Segment List, replaces it with the target IPv6 address, and forwards the packet. During this forwarding process, all SIDs in the Segment List can be intercepted. For businesses with special security requirements, such as finance and logistics, the nodes in the Segment List represent the nodes that collectively process that business. The Function and Args fields in the SIDs define the node's processing requirements for the carried data. Exposing this information completely poses a security risk. The encrypted segment list is then filled into the SRv6 packet, and the Segment List in the SRH header... The SID value in the List is encrypted and protected based on a pre-configured key. Two node keys and a random key are used to encrypt and protect the Locator value, Function, and Args of the forwarding path, respectively. Furthermore, each SID is encrypted collaboratively by two forwarding nodes. This significantly increases the difficulty for attackers to intercept the complete forwarding path and business processing rules, thereby improving the security of the business at the network layer.

[0087] In one embodiment, the IPv6 header includes, but is not limited to, the following fields: Version, TrafficClass, Flow Label, Payload Length, Next HDR, Hop Limit, Source Address, DestinationAddress, etc.

[0088] In one embodiment, the SR Header includes, but is not limited to, the following fields: Next Header, Hdr Ext Len, Routing Type, Segment Left, Last Entry, Flags, SegmentList, Optional TLVs, etc.

[0089] The SID in the Segment List includes: the node network address parameter Lacator, the function parameter field, and the Args field, which are the function definition and parameters of the SRv6 packet processed by the node, respectively. They do not have routing information or identification functions. Among them, the IPv6 address is 128 bits in total, the SID is also 128 bits in total, the Lacator is 64 bits, and the Function and Args are 64 bits in total.

[0090] In one embodiment, multiple random keys corresponding to multiple target forwarding nodes are stored in the OptionalTLVs field. Specifically, a random seed key generator generates corresponding random keys for multiple target forwarding nodes on the forwarding path, each random key being 128 bits. Based on the order of the encrypted segment list, multiple random keys are stored in the OptionalTLVs field of the SRv6 data packet and sent with the SRv6 data packet. Intermediate nodes and terminal nodes only read the contents of the OptionalTLVs field and do not modify them. The random key queue is only used for one service, so that the encryption key is different for each service, ensuring the reliability of information protection.

[0091] In one embodiment, the first node key and the second node key corresponding to multiple target forwarding nodes on the forwarding path are stored in a key store.

[0092] The SRv6 protocol forwarding path encryption protection method requires configuring pre-configured keys on network devices participating in SRv6 forwarding. The SRv6 headend device is the initiator and organizer of related services and stores a pre-shared key store for all participating nodes. Figure 5 This diagram illustrates a keystore structure according to an embodiment of the present disclosure, such as... Figure 5As shown, the SR device identifier is the Locator of the device, and there are two pre-configured keys: the first node key Pre_Key_L_i and the second node key Pre_Key_FA_i. Both keys are 128 bits and are used to encrypt the Loactor, Function, and Args fields of the forwarding node, respectively, thereby protecting the entire forwarding path and functional parameters in the Segment List. Using two different pre-configured node keys to encrypt the Loactor, Function, and Args parameters respectively increases the difficulty of attacks. According to the SRv6 protocol, when an SRv6 packet is forwarded to the next forwarding node, the SID value of the next forwarding node is extracted from the Segment List in the SRH packet header of each node and decrypted. The decrypted Locator value is then filled with a 64-bit random value to make a 128-bit SID. This SID is then used to replace the destination address in the IPv6 packet header. In other words, before forwarding, the Locator value of the next forwarding node is extracted and placed in the destination address of the IPv6 packet header. The Function and Args fields can be empty or random numbers. The Segment Left value is decremented by 1. After the operation is completed, the SRv6 packet is forwarded.

[0093] It should be noted that the originating node configures two node keys for all forwarding nodes, namely the first node key and the second node key, to complete the encryption of the SID in the entire encrypted Segment List. Intermediate nodes and the terminal node only have their own two node keys.

[0094] In one embodiment, any 128-bit or 256-bit random number can be used as the first node key, the second node key, the random key, etc.; the first node key, the second node key, and / or the random key corresponding to each forwarding node can be the same or different; the first node key, the second node key, and / or the random key corresponding to the same forwarding node can be the same or different.

[0095] In the above embodiments, one SID is encrypted and decrypted by two forwarding nodes working together. This significantly increases the difficulty for attackers to intercept the complete forwarding path and business processing rules, effectively protecting customized paths from being intercepted and spied on. It improves the security of services from the network layer and is suitable for application scenarios involving multiple hosts working together, avoiding additional forwarding latency caused by data packet processing.

[0096] Figure 6 This diagram illustrates a flowchart of an encryption processing method for an originating node according to an embodiment of the present disclosure, as follows: Figure 6 As shown in the embodiments of this disclosure, the originating node encryption processing method is applied to the originating node and includes the following steps:

[0097] S602, the originating node first defines the SRv6 forwarding path according to business needs, as well as the functions and parameters specified by each node, forming a complete original segment list. At the same time, a new segment list encryption information table is generated corresponding to the original segment list table to store the encrypted segment list, i.e., the encrypted segment list. The encrypted segment list table will be placed in the SRH header of the SRv6 data packet.

[0098] In S604, each forwarding node has two pre-configured node keys stored in the pre-configured key store of the originating node. Simultaneously, the originating node also has a random seed key generator, generating a 128-bit random key for each forwarding node along the forwarding path. The random key corresponds to the order of the encrypted segment list, forming a field column stored in the Optional TLVs field of the SRH packet header. This field is sent with the SRv6 data packet. Intermediate and terminal nodes only read the contents of the Optional TLVs field, without modifying it. The random key queue is used only once for business operations, ensuring that the encryption key is different for each business operation and guaranteeing the reliability of information protection.

[0099] S606, the originating node encrypts the Locator field of the network address parameter and the Function and Args content of all forwarding nodes according to the pre-configured node key and the randomly generated random key, thus completing the encryption of the SID in the entire Segment List.

[0100] Figure 7 This diagram illustrates an encryption protection method according to an embodiment of the present disclosure, such as... Figure 7 As shown:

[0101] For forwarding node i, the originating node first extracts the last 64 bits corresponding to forwarding node i from the original Segment List table, which are the Function and Args fields. The stored pre-configured first node key Pre_Key_FA_i of the forwarding node is XORed with the random key Seed_Key_i generated by the random seed key generator to form the first encryption key. The stream is encrypted using the 128-EEA3 stream cipher algorithm to obtain the encrypted Function and Args parameter fields. The encrypted content is filled into the Function and Args fields of forwarding node i in the encrypted Segment List table and stored.

[0102] The pre-configured second node key Pre_key_L_i of the forwarding node is XORed with the random key Seed_Key_i generated by the random seed key generator to obtain a second encryption key. The next forwarding node, i.e., the Locator field of forwarding node i+1, is extracted from the original Segment List table. The Locator field is then encrypted using the 128-EEA3 algorithm with the second encryption key to obtain an encrypted Locator field. This encrypted content is then filled into the Locator field of forwarding node i+1 in the encrypted Segment List table.

[0103] It should be noted that the 128-EEA3 sequence algorithm in the Zu Chongzhi algorithm of the Chinese cryptography system is used for information encryption and decryption. This algorithm belongs to the stream cipher technology, and the encrypted ciphertext has the same length as the original text.

[0104] S608, followed by the operations of S606, ultimately forms a complete encrypted Segment List, which is then filled into the SRH of the data packet.

[0105] It should be noted that the Locator field of the next forwarding node corresponding to the originating node does not need to be encrypted, because the originating node will place the Locator as the destination address in the IPv6 packet header.

[0106] S610, after completing the above operations, encapsulate the complete IPv6 packet. The destination address of the IPv6 packet is the Locator value of the next forwarding node corresponding to the originating node. The Function and Args fields can be empty or random numbers. Decrement the SegmentLeft value by 1. After the operation is complete, forward the SRv6 packet.

[0107] When SRv6 packets carrying business information are transmitted and forwarded, the packets may be intercepted. Attackers can obtain the SRv6 forwarding Segment List, thereby gaining information on the nodes involved in business processing, as well as the Function and Args parameters of each node. Therefore, for services with high security requirements, it is necessary to encrypt and protect the Segment List. The above embodiment provides full encryption protection for the entire Segment List. At the same time, considering that the Locator in the SID is to be replaced at each node as the target address of the next node, two different pre-configured node keys are used to complete the encryption. The Locator content of this forwarding node uses the Pre_Key_L key of the previous forwarding node, while the Function and Args parameter values ​​use the Pre_Key_FA key of this forwarding node. This significantly increases the difficulty of attack and cracking. In addition, a random key is carried in the Optional TLVs field to ensure that the encryption key is different each time. This protects high-security services and data at the network layer, making it suitable for application scenarios involving multiple hosts and avoiding additional forwarding delays caused by packet processing.

[0108] Figure 8 This diagram illustrates a flowchart of an encryption method for intermediate and terminal nodes according to an embodiment of the present disclosure. Figure 8 As shown in the embodiments of this disclosure, the encryption processing method for intermediate nodes and terminal nodes is applied to intermediate nodes and terminal nodes, and includes the following steps:

[0109] S802, after receiving the SRv6 data packet sent by the previous forwarding node, the intermediate node and the terminal node determine their position in the Segment List based on the value of the Segment Left field of the SRv6 data packet, and extract the corresponding random key Seed_Key_i from the Optional TLVs list and the lower 64 bits of the corresponding SID from the Segment List.

[0110] S804, the pre-configured first node key Pre_Key_FA_i stored in the intermediate node and the terminal node are XORed with the random key Seed_Key_i to obtain the first decryption key. The first decryption key is then decrypted with the lower 64 bits of the SID using the 128-EEA3 algorithm. The decrypted content is the Function+Args value of this node.

[0111] S806: Extract the high 64 bits of the next forwarding node's SID from the Segment List based on the Segment Left value. Extract the pre-configured second node key Pre_Key_L_i of this intermediate node and perform an XOR operation with the random key Seed_Key_i to obtain the second decryption key. Use the second decryption key to perform a decryption operation using the 128-EEA3 algorithm to obtain the Locator value of the next forwarding node.

[0112] S808 takes the decrypted Locator value as the high 64 bits, fills the low 64 bits with a random 64-bit number or 64 bits of zeros, replaces the destination address in the IPv6 packet header, and then forwards the packet.

[0113] The terminal node only needs to decrypt the Function and Args of its own node. It does not need to decrypt the Locator value of the next forwarding node. The rest is the same as the intermediate node, so it will not be described in detail here.

[0114] In the above embodiments, the Lactor field is encrypted separately from the Function and Args fields. After the SRv6 packet is intercepted, the attacker cannot understand the completed forwarding address chain, as well as the Function and Args content of each node. This is suitable for application scenarios involving multiple hosts in collaboration, such as blockchain. After producing a block, the node needs to forward the block data to the business host on the chain. Based on the SRv6 protocol, all the hosts on the chain are placed in the Segment List, so that multiple machines can receive the data at once. The SID is encrypted and protected based on the above method, which not only improves the block sending efficiency, but also protects the highly secure business and data at the network layer. At the same time, it can be implemented on various hardware and software platforms, making it easy to promote and use.

[0115] Based on the same inventive concept, this disclosure also provides an SRv6 protocol forwarding path transmission device, as shown in the following embodiment. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiment, the implementation of this device embodiment can refer to the implementation of the above-described method embodiment, and repeated details will not be elaborated further.

[0116] Figure 9 This diagram illustrates an SRv6 protocol forwarding path transmission device according to an embodiment of the present disclosure, such as... Figure 9 As shown, the SRv6 protocol forwarding path transmission device 9 includes: a parameter receiving module 901, a decryption generation module 902, a first decryption module 903, a second decryption module 904, and a forwarding module 905;

[0117] The parameter receiving module 901 determines the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node.

[0118] The decryption generation module 902 obtains the first decryption key and the second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node.

[0119] The first decryption module 903 decrypts the encrypted function parameters corresponding to the target forwarding node according to the first decryption key to obtain the function parameters corresponding to the target forwarding node;

[0120] The second decryption module 904 decrypts the encrypted node network address parameters corresponding to the next forwarding node according to the second decryption key to obtain the node network address parameters corresponding to the next forwarding node.

[0121] Forwarding module 905 replaces the filled node network address parameters with the target address and forwards the SRv6 data packet to the next forwarding node corresponding to the target address.

[0122] In the above embodiments, based on the SRv6 protocol framework, the SID value in the Segment List in the SRH is encrypted and protected using pre-configured node keys. Two node keys and a random key are used to encrypt and protect the Locator value, Function, and Args of the forwarding path, respectively. Furthermore, each SID is encrypted and decrypted collaboratively by two forwarding nodes. This significantly increases the difficulty for attackers to intercept the complete forwarding path and service processing rules, effectively protecting customized paths from being intercepted and spied on, and improving service security at the network layer.

[0123] Figure 10 This diagram illustrates an SRv6 protocol forwarding path transmission device according to an embodiment of the present disclosure, such as... Figure 10 As shown, the SRv6 protocol forwarding path transmission device 10 includes: a key acquisition module 1001, an encryption generation module 1002, a first encryption module 1003, and a second encryption module 1004;

[0124] The key acquisition module 1001 acquires the random keys, the first node key, and the second node key corresponding to multiple target forwarding nodes;

[0125] The encryption generation module 1002 generates a first encryption key and a second encryption key by combining the random key with the first node key and the second node key;

[0126] The first encryption module 1003 encrypts and generates the encrypted node network address parameters corresponding to the next forwarding node according to the first encryption key;

[0127] The second encryption module 1004 encrypts and generates the encryption function parameters corresponding to the target forwarding node according to the second encryption key.

[0128] In one embodiment, the SRv6 protocol forwarding path transmission device further includes a filling module, which generates an encrypted segment list by taking the network address parameters, encryption function parameters and random keys of multiple encrypted nodes corresponding to multiple target forwarding nodes and filling it into the SRv6 data packet.

[0129] In one embodiment, the SRv6 protocol forwarding path transmission device further includes a first storage module for storing multiple random keys corresponding to multiple target forwarding nodes into the Optional TLVs field.

[0130] In one embodiment, the SRv6 protocol forwarding path transmission device further includes a second storage module for storing the first node key and the second node key corresponding to multiple target forwarding nodes on the forwarding path into a key library.

[0131] In the above embodiments, the encryption and protection of the forwarding path table of the Segment List in the SRv6 protocol is very suitable and meaningful for scenarios that want to apply the technical advantages of the programmable and customizable forwarding path of the SRv6 protocol while also wanting to protect the path information. These scenarios include the financial and logistics fields. One SID is encrypted and decrypted by two forwarding nodes working together, which increases the difficulty for attackers to intercept the complete forwarding path and business processing rules. This effectively protects the customized path from being intercepted and spied on, improves the security of the business at the network layer, and is suitable for application scenarios involving multiple hosts working together, avoiding additional forwarding latency caused by data packet processing.

[0132] Figure 11 A schematic diagram of an exemplary system architecture that can be applied to the SRv6 protocol forwarding path transmission method or SRv6 protocol forwarding path transmission apparatus in embodiments of this disclosure is shown.

[0133] like Figure 11 As shown, the system architecture may include an SRv6 packet encryption control module 1101, an SRv6 forwarding node key database 1102, an SRv6 packet processing engine 1103, a random seed key generator 1104, a 128-EEA3 encryption algorithm engine 1105, and an encryption key generator 1106.

[0134] SRv6 packet encryption control module: This module is the core unit. It is responsible for controlling and allocating the entire SRv6 encryption and decryption process and business requirements through the network communication interface according to the operation of the business, and coordinating and managing the operation of other modules.

[0135] SRv6 forwarding node key database: This database persistently stores key information data for each forwarding node, including the device's Locator identifier and two pre-configured keys. The corresponding pre-configured key can be retrieved by using the device's Locator identifier.

[0136] SRv6 packet processing engine: This engine parses and encapsulates packets according to the IPv6 and SRv6 protocols, extracts the SID value of the Segment List from the SRH header, and encapsulates new packets after processing.

[0137] Random seed key generator: used to generate Seed_key, which, together with the pre-configured node key, generates encryption and decryption keys;

[0138] 128-EEA3 Encryption Algorithm Engine: Under the coordination of the SRv6 forwarding path encryption control module, this module follows the 128-EEA3 Zu Chongzhi sequence encryption and decryption algorithm to encrypt or decrypt the SIDs in the Segment List.

[0139] Encryption Key Generator: This module calculates and generates encryption and decryption keys based on the SRv6 forwarding node key database and the random key generated by the random seed key generator.

[0140] In the above embodiments, while implementing path encryption protection, it can be implemented in the ASIC resources of a simple network card, without the participation of CPU and operating system software. This avoids additional forwarding latency caused by data packet processing, and the difficulty for attackers to intercept the complete forwarding path and business processing rules is multiplied. It effectively protects customized paths from being intercepted and spied on, and improves the security of services from the network layer.

[0141] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0142] The following reference Figure 12 To describe an electronic device 1200 according to such an embodiment of the present disclosure. Figure 12 The electronic device 1200 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0143] like Figure 12As shown, the electronic device 1200 is manifested in the form of a general-purpose computing device. The components of the electronic device 1200 may include, but are not limited to: at least one processing unit 1210, at least one storage unit 1220, and a bus 1230 connecting different system components (including storage unit 1220 and processing unit 1210).

[0144] The storage unit stores program code that can be executed by the processing unit 1210, causing the processing unit 1210 to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

[0145] For example, the processing unit 1210 can execute the following steps of the above method embodiment: Generate an encrypted segment list by taking the encrypted node network address parameters, encryption function parameters, and random keys corresponding to multiple target forwarding nodes, and fill it into the SRv6 data packet; the target forwarding node determines the random key and encryption function parameters corresponding to the target forwarding node, and the encrypted node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node; obtain a first decryption key and a second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node; decrypt the encryption function parameters corresponding to the target forwarding node using the first decryption key to obtain the function parameters corresponding to the target forwarding node; decrypt the encrypted node network address parameters corresponding to the next forwarding node using the second decryption key to obtain the node network address parameters corresponding to the next forwarding node; replace the filled node network address parameters with the target address, and forward the SRv6 data packet to the next forwarding node corresponding to the target address.

[0146] Storage unit 1220 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 12201 and / or cache memory 12202, and may further include a read-only memory (ROM) 12203.

[0147] Storage unit 1220 may also include a program / utility 12204 having a set (at least one) of program modules 12205, such program modules 12205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0148] Bus 1230 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0149] Electronic device 1200 can also communicate with one or more external devices 1240 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1200, and / or any device that enables electronic device 1200 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1250. Furthermore, electronic device 1200 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1260. As shown, network adapter 1260 communicates with other modules of electronic device 1200 via bus 1230. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1200, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0150] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0151] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0152] For example, when the program product in this embodiment is executed by the processor, it implements the following steps: A list of encrypted segments is generated from the encrypted node network address parameters, encryption function parameters, and random keys corresponding to multiple target forwarding nodes, and filled into the SRv6 data packet; the target forwarding node determines the random key and encryption function parameters corresponding to the target forwarding node, and the encrypted node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node; a first decryption key and a second decryption key are obtained based on the first node key, the second node key, and the random key corresponding to the target forwarding node; the encrypted function parameters corresponding to the target forwarding node are decrypted based on the first decryption key to obtain the function parameters corresponding to the target forwarding node; the encrypted node network address parameters corresponding to the next forwarding node are decrypted based on the second decryption key to obtain the node network address parameters corresponding to the next forwarding node; the filled node network address parameters are replaced with the target address, and the SRv6 data packet is forwarded to the next forwarding node corresponding to the target address.

[0153] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0154] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0155] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0156] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0157] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0158] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0159] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0160] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for forwarding path transmission of the SRv6 protocol, characterized in that, Applied to target forwarding nodes, including: The random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node are determined based on the SRv6 data packet sent by the previous forwarding node. The first decryption key and the second decryption key are obtained based on the first node key and the second node key corresponding to the target forwarding node and the random key; Decrypt the encrypted function parameters corresponding to the target forwarding node using the first decryption key to obtain the function parameters corresponding to the target forwarding node; Decrypt the encrypted node network address parameters corresponding to the next forwarding node according to the second decryption key to obtain the node network address parameters corresponding to the next forwarding node; Replace the filled-in node network address parameter with the target address, and forward the SRv6 data packet to the next forwarding node corresponding to the target address.

2. The SRv6 protocol forwarding path transmission method according to claim 1, characterized in that, The process of determining the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node based on the SRv6 data packet sent by the previous forwarding node, includes: Receive the SRv6 data packet sent by the previous forwarding node; The location data of the target forwarding node is determined based on the Segment Left field value of the SRv6 data packet; Based on the location data, determine the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node.

3. The SRv6 protocol forwarding path transmission method according to claim 2, characterized in that, The step of determining the random key and encryption function parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node based on the location data, includes: The random key corresponding to the target forwarding node is determined based on the Optional TLVs field of the SRv6 data packet and the location data.

4. The SRv6 protocol forwarding path transmission method according to claim 1 or 3, characterized in that, The step of obtaining the first decryption key and the second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node includes: The first node key and the second node key are obtained based on the node network address parameters corresponding to the target forwarding node; The first decryption key is obtained based on the first node key and the random key; The second decryption key is obtained based on the second node key and the random key.

5. The SRv6 protocol forwarding path transmission method according to claim 1, characterized in that, Before determining the random key and encryption parameters corresponding to the target forwarding node, and the encryption node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node, the method further includes: Obtain the random key, the first node key, and the second node key corresponding to the target forwarding node; The random key is combined with the first node key and the second node key to generate a first encryption key and a second encryption key; The encrypted node network address parameters corresponding to the next forwarding node are generated by encrypting the second encryption key. The encryption function parameters corresponding to the target forwarding node are generated by encrypting the first encryption key.

6. The SRv6 protocol forwarding path transmission method according to claim 5, characterized in that, Also includes: The network address parameters, encryption function parameters, and random keys of the multiple encrypted nodes corresponding to the multiple target forwarding nodes are used to generate an encrypted segment list, which is then filled into the SRv6 data packet.

7. The SRv6 protocol forwarding path transmission method according to claim 5, characterized in that, Also includes: Store multiple random keys corresponding to multiple target forwarding nodes into the Optional TLVs field; Store the multiple first node keys and multiple second node keys corresponding to the multiple target forwarding nodes in the key store.

8. A method for forwarding path transmission of the SRv6 protocol, characterized in that, Applied to configuration nodes, including: Obtain the random keys, first node key, and second node key corresponding to multiple target forwarding nodes; The random key is combined with the first node key and the second node key to generate a first encryption key and a second encryption key; wherein, the first encryption key corresponds to the first decryption key; and the second encryption key corresponds to the second decryption key. The encrypted node network address parameters corresponding to the next forwarding node are generated by encrypting the first encryption key. The encrypted function parameters corresponding to the target forwarding node are generated by encrypting the data using the second encryption key.

9. The SRv6 protocol forwarding path transmission method according to claim 8, characterized in that, Also includes: The encrypted node network address parameters, encryption function parameters, and random keys corresponding to multiple target forwarding nodes are used to generate an encrypted segment list, which is then filled into the SRv6 data packet.

10. The SRv6 protocol forwarding path transmission method according to claim 9, characterized in that, Also includes: The random key is generated for the multiple target forwarding nodes on the forwarding path according to the random seed key generator; Based on the order of the encrypted segment list, multiple random keys are stored in the OptionalTLVs field of the SRv6 data packet.

11. The SRv6 protocol forwarding path transmission method according to claim 8, characterized in that, Also includes: Store the first node key and the second node key corresponding to multiple target forwarding nodes on the forwarding path into the key store.

12. An SRv6 protocol forwarding path transmission device, characterized in that, include: The parameter receiving module determines the random key and encryption function parameters corresponding to the target forwarding node, as well as the encryption node network address parameters of the next forwarding node, based on the SRv6 data packet sent by the previous forwarding node. The decryption generation module obtains a first decryption key and a second decryption key based on the first node key, the second node key, and the random key corresponding to the target forwarding node; The first decryption module decrypts the encrypted function parameters corresponding to the target forwarding node according to the first decryption key to obtain the function parameters corresponding to the target forwarding node; The second decryption module decrypts the encrypted node network address parameters corresponding to the next forwarding node according to the second decryption key to obtain the node network address parameters corresponding to the next forwarding node. The forwarding module replaces the filled-in node network address parameters with the target address and forwards the SRv6 data packet to the next forwarding node corresponding to the target address.

13. An SRv6 protocol forwarding path transmission device, characterized in that, include: The key acquisition module acquires random keys, first node keys, and second node keys corresponding to multiple target forwarding nodes; The encryption generation module generates a first encryption key and a second encryption key by combining the random key with the first node key and the second node key; wherein the first encryption key corresponds to the first decryption key; and the second encryption key corresponds to the second decryption key. The first encryption module encrypts and generates the encrypted node network address parameters corresponding to the next forwarding node based on the first encryption key. The second encryption module encrypts and generates the encryption function parameters corresponding to the target forwarding node based on the second encryption key.

14. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the SRv6 protocol forwarding path transmission method according to any one of claims 1 to 11 by executing the executable instructions.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the SRv6 protocol forwarding path transmission method according to any one of claims 1 to 11.

Images