Packet verification method and device, related equipment and storage medium

Abstract

The application discloses a message verification method and device, related equipment and a storage medium. The method comprises the following steps: a first node verifies a first message based on a first data table. The first data table is indexed by a token and stores first information corresponding to each message forwarding path in at least one message forwarding path. The token is obtained by mapping a corresponding message forwarding path.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a message verification method, apparatus, related equipment and storage medium. Background Technology

[0002] Among related technologies, Software Defined Wide Area Network (SD-WAN) based on Segment Routing IPv6 (IPv6) poses network security risks. Summary of the Invention

[0003] To address the related technical issues, embodiments of this application provide a message verification method, apparatus, related equipment, and storage medium.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides a message verification method applied to a first node, the method comprising:

[0006] Based on the first data table, verify the first message; where...

[0007] The first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path.

[0008] In the above scheme, the first information includes at least one of the following:

[0009] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0010] The corresponding message forwarding path is located at the next hop (NH, Next Hop) address corresponding to the first node.

[0011] The method in the above scheme further includes:

[0012] The first message is discarded if the verification result of the first message meets at least one of the following conditions:

[0013] The first message did not carry a token;

[0014] The first message carries a first token, and the first token does not exist in the first data table;

[0015] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message in the first node;

[0016] The first message carries a first token, the first token exists in the first data table, and the first next-hop address and the second next-hop address do not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0017] The method in the above scheme further includes:

[0018] Based on the first token carried in the first message, the next-hop address of the first message is determined in the first data table; wherein,

[0019] The next-hop address of the first message is the next-hop address in the first information indexed by the first token.

[0020] In the above scheme, the first token is obtained by mapping the segment list of the first message.

[0021] In the above scheme, the first token carried by the first message is encapsulated in the segment routing header (SRH) of the first message.

[0022] The method in the above scheme further includes:

[0023] Receive second information from a Border Gateway Protocol (BGP) device; the second information includes a second token and a segment list of the second message;

[0024] Write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

[0025] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0026] In the above scheme, the first node includes a provider edge (PE) device and / or a point-of-presence (PoP).

[0027] This application also provides a message verification method applied to a customer-premise equipment (CPE), the method comprising:

[0028] Send the first message to the first node; among which,

[0029] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0030] In the above scheme, the first information includes at least one of the following:

[0031] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0032] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0033] In the above scheme, the first message carries at least a first token, and also carries a second ingress interface number and / or pointer (SL, Segment Left); wherein,

[0034] The second ingress interface number represents the ingress interface number of the first message at the first node;

[0035] The SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address of the first message at the first node.

[0036] In the above scheme, the first token is encapsulated in the SRH of the first message.

[0037] This application also provides a message verification method applied to a BGP device, the method comprising:

[0038] Send the second message to the first node; among which,

[0039] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table;

[0040] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0041] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0042] In the above scheme, the first information includes one of the following:

[0043] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0044] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0045] In the above scheme, the method further includes: sending the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

[0046] In the above scheme, the first node includes a PE device and / or a PoP.

[0047] This application also provides a message verification device, including:

[0048] The verification unit is used to verify the first message based on the first data table; wherein,

[0049] The first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path.

[0050] This application also provides a message verification device, including:

[0051] The first sending unit is used to send a first message to the first node; wherein...

[0052] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0053] This application also provides a message verification device, including:

[0054] The second sending unit is used to send second information to the first node; wherein...

[0055] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table;

[0056] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0057] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0058] This application embodiment also provides a network device, including a first processor and a first communication interface, wherein,

[0059] The first processor is configured to verify the first message based on a first data table; wherein,

[0060] The first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path.

[0061] This application embodiment also provides a client terminal device, including a second processor and a second communication interface, wherein,

[0062] The second communication interface is used to send a first message to the first node; wherein,

[0063] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0064] This application also provides a network device, including a third processor and a third communication interface, wherein,

[0065] The third communication interface is used to send the second information to the first node; wherein...

[0066] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table;

[0067] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0068] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0069] This application also provides a network device, including a first processor and a first memory for storing computer programs that can run on the first processor.

[0070] Wherein, when the first processor is used to run the computer program, it executes the steps of any one of the methods described above on the first node side.

[0071] This application also provides a client terminal device, including a second processor and a second memory for storing computer programs that can run on the second processor.

[0072] Wherein, when the second processor is used to run the computer program, it executes the steps of any of the methods described above on the CPE side.

[0073] This application also provides a network device, including a third processor and a third memory for storing computer programs capable of running on the third processor.

[0074] When the third processor runs the computer program, it executes the steps of any of the methods described above on the BGP device side.

[0075] This application embodiment also provides a storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, it implements the steps of any of the methods described above on the first node side, or implements the steps of any of the methods described above on the CPE side, or implements the steps of any of the methods described above on the BGP device side.

[0076] In the message verification method, apparatus, related devices, and storage medium provided in this application embodiment, the CPE sends a first message to a first node, and the first node verifies the first message based on a first data table. The first data table, indexed by a token, stores first information corresponding to each message forwarding path in at least one message forwarding path. The token is obtained by mapping the corresponding message forwarding path. In this scheme, each first node can verify the legality of the received first message based on the first data table, thereby reducing network security risks. Furthermore, the first data table, indexed by a token, reduces the maintenance difficulty of the first data table. The first node can query the first information corresponding to each forwarding path in the first data table based on the token, without needing to use segment identifiers (SIDs) to retrieve or compare path information, thus reducing computational load and saving query time, thereby reducing the difficulty of hardware deployment. Attached Figure Description

[0077] Figure 1 This is a schematic diagram of the structure of SID in related technologies;

[0078] Figure 2 This is a schematic diagram of the SRH structure in related technologies;

[0079] Figure 3 This is a schematic diagram of the network architecture in related technologies;

[0080] Figure 4 This is a schematic diagram illustrating the implementation process of a message verification method according to an embodiment of this application;

[0081] Figure 5 This is a schematic diagram of a message verification method according to an embodiment of this application;

[0082] Figure 6 This is a schematic diagram of a message forwarding method according to an embodiment of this application;

[0083] Figure 7 This is a schematic diagram illustrating the implementation process of a message verification method according to an embodiment of this application;

[0084] Figure 8 This is a schematic diagram illustrating the implementation process of a message verification method according to an embodiment of this application;

[0085] Figure 9 This is a schematic diagram of the interaction process of a message verification method according to an embodiment of this application;

[0086] Figure 10 This is a schematic diagram of a message verification device according to an embodiment of this application;

[0087] Figure 11 This is a schematic diagram of a message verification device according to an embodiment of this application;

[0088] Figure 12 This is a schematic diagram of a message verification device according to an embodiment of this application;

[0089] Figure 13 This is a schematic diagram of a network device structure according to an embodiment of this application;

[0090] Figure 14 This is a schematic diagram of a customer terminal device structure according to an embodiment of this application;

[0091] Figure 15 This is a schematic diagram of a network device structure according to an embodiment of this application. Detailed Implementation

[0092] Before introducing the embodiments of this application, the relevant technologies will be described first:

[0093] Segment routing (SR) is a source routing technique that allocates segments to nodes, links, or service functions in the network and combines these segments as needed at the header node to form a segment sequence, or segment list, encapsulated in the packet header. When a packet arrives at the ingress of the SR field, a segment sequence can be pushed onto it as needed, guiding the packet sequentially to the corresponding node, link, or service function according to the instructions in the segment sequence.

[0094] The advantages of SR can be summarized in four aspects:

[0095] Simplified control protocols: SR distributes SIDs through Interior Gateway Protocol (IGP) and BGP, eliminating the need to deploy and maintain traditional label distribution protocols (LDP) and resource reservation protocols based on traffic engineering extensions such as RSVP-TE (Resource Reservation Protocol-TrafficEngineering).

[0096] High scalability: SR generates a massive number of SR paths by combining a limited number of links and node segments, and the path information only needs to be stored in the head node, while the intermediate nodes of the network do not need to maintain path state information.

[0097] Programmability: In the SR technology system, a segment can be viewed as an instruction. Combining segments to form SR paths that meet specific needs can be seen as programming the network. This programming allows for the flexible creation of paths that meet different requirements, unlocking the value of the network.

[0098] High reliability protection: SR provides 100% network coverage with Fast Re-Route protection, solving a long-standing technical challenge for Internet Protocol (IP) networks and achieving complete reliability protection under highly scalable conditions.

[0099] SRv6 is an SR source routing technology implemented based on IPv6. The SID length of SRv6 is 128 bits, consistent with the IPv6 address. For example... Figure 1 As shown, the format of a SID typically consists of three parts: a Locator, a Function, and an optional Argument.

[0100] The Locator is an identifier assigned to a network node for routing and forwarding data packets. In SRv6SID, the Locator is a variable-length part to adapt to networks of different sizes. The Locator identifier has two important attributes: routable and aggregable.

[0101] A function is used to express the forwarding action to be performed by an instruction; it is equivalent to the opcode of a computer instruction. In SRv6 network programming, different forwarding behaviors are expressed by different functions.

[0102] Argument is an optional field used to carry parameters required when executing instructions. These parameters may contain streams, services, or any other relevant information.

[0103] The above definition of the SRv6 SID format allows SRv6 SIDs to be used flexibly to indicate various operations and parameters in the network.

[0104] On the other hand, SRv6 introduces a new SRH (Signal Header) in the IPv6 routing extension header to carry a sequence of SRv6 SIDs, enabling flexible programming of SRv6 network paths and various functions. The SRH can also include an optional TLV (Type-Length-Value) field for carrying variable-length data, providing better scalability for SRv6. The format of the SRH is as follows: Figure 2 As shown.

[0105] While inheriting all the advantages of SR, SRv6 gains stronger scalability and programmability through its integration with IPv6, offering unique advantages in network simplification and meeting new service requirements. However, in SRv6-based SD-WAN, because SR source routing technology encodes all network information into packets, all path information is carried in packets initiated by the user side without constraint, leading to excessive user control. Furthermore, extending SRv6 networks to untrusted user sides poses a risk of unauthorized access to network resources. Figure 3 As shown, for example in cloud scenarios, the CPE is located in an untrusted domain. By specifying the path in the message, users can not only access their own Virtual Private Cloud (VPC), but also illegally access other users' VPCs, which brings network security risks.

[0106] To address the network security risks posed by excessive user control in SRv6-based SD-WAN, the following three message verification schemes have been proposed in related technologies:

[0107] Option 1: Jump-by-jump verification

[0108] The standard recommends using key-based hash-based message authentication codes (HMAC) to verify legitimate SRv6 paths, but this is difficult to implement. The reasons are: current router hardware does not support HMAC calculation, requiring hardware upgrades, which are costly; and the huge computational load of HMAC verification on the router will severely impact forwarding efficiency.

[0109] Option 2: Entry Inspection

[0110] Access Control Lists (ACLs) can be used to match and filter traffic. However, the length of the SID list is not fixed, ACLs consume a lot of resources, and are not suitable for large-scale deployment. ACLs need to match the SID list, which is difficult to maintain and use.

[0111] Option 3: Inspection at both ends

[0112] While message verification at both the CPE and PoP ends can prevent unauthorized access, it cannot prevent Distributed Denial of Service (DDoS) attacks because the intermediate nodes do not verify the received messages.

[0113] Path verification needs to support flexible hop-by-hop, first-and-last, or arbitrary node combination verification to reduce the difficulty of hardware deployment.

[0114] Based on this, in various embodiments of this application, the CPE sends a first message to the first node, and the first node verifies the first message based on a first data table; wherein, the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path. In the above scheme, each first node can verify the legality of the received first message based on the first data table, thereby reducing network security risks. Furthermore, using a token as an index for the first data table reduces the maintenance difficulty of the first data table. The first node can query the first information corresponding to each forwarding path in the first data table based on the token, without needing to use the SID to retrieve or compare path information, which reduces computational load and saves query time, thereby reducing the difficulty of hardware deployment.

[0115] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0116] This application provides a message verification method applied to a first node, which can be a router or a virtual routing device. The first node includes a PE device and / or a PoP (Point of Presence). See also... Figure 4The method includes:

[0117] Step 401: Verify the first message based on the first data table.

[0118] The first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0119] Here, the first node stores a first data table, and different first nodes store different first data tables. When a first node receives a first message, it verifies the first message based on the first data table to obtain the verification result of the first message. For example, it verifies the first message based on the token in the first data table and / or the first information indexed by the corresponding token to obtain the verification result of the first message.

[0120] The first message can be sent by the CPE or by other first nodes. If the verification result indicates success, the first message is considered valid, and the first node forwards the first message based on its next-hop address. If the verification result indicates failure, the first message is considered invalid, and the first node discards the first message. The next-hop address can be the next-hop SID.

[0121] The first data table is also called the legitimate path verification table. The first information is the legitimate path information corresponding to the first node. Each token corresponds to a message forwarding path, and the token and the corresponding first information are stored together in the first data table. The token can be a hash value calculated based on the message forwarding path, or it can be a random number assigned to the corresponding message forwarding path.

[0122] It should be noted that the first node can enable message verification by default, or enable or disable message verification as needed. When message verification is enabled or disabled, the first node verifies the first message based on the first data table.

[0123] To improve the reliability of message verification results and thus reduce network security risks, in one embodiment, the first information includes at least one of the following:

[0124] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0125] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0126] Here, in the first data table, the next-hop address can be marked as NH, and the ingress interface number can be marked as IngIF. The ingress interface number represents the ingress interface information of the tunnel. The tunnel can be an Internet Protocol Security (IPSec) tunnel, or a Generic Routing Encapsulation (GRE) tunnel, etc.

[0127] The ingress interface number in the first information is used to verify the ingress interface number in the first message when the ingress interface of the first node is a tunnel.

[0128] The next-hop address in the first message is used to verify the next-hop address in the first message. The next-hop address in the first message refers to the next-hop address of the first message corresponding to the first node.

[0129] Considering that when the first node forwards user packets containing illegal path information, it may cause the corresponding user to illegally access other users' VPCs, thereby triggering network security risks, such as data leakage, in order to reduce network security risks, in one embodiment, the method further includes:

[0130] The first message is discarded if the verification result of the first message meets at least one of the following conditions:

[0131] The first message did not carry a token;

[0132] The first message carries a first token, and the first token does not exist in the first data table;

[0133] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message in the first node;

[0134] The first message carries a first token, the first token exists in the first data table, and the first next-hop address and the second next-hop address do not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0135] Here, the first node supports both a first verification mode and a second verification mode. The first node determines which verification mode to use to verify the first packet based on the configuration information. The first verification mode is also called the source routing path mode, and the second verification mode is also called the non-source routing path mode. In the first verification mode, the first node verifies the first packet based on the token corresponding to the packet forwarding path in the first data table, as well as the next-hop address and / or ingress interface number. In the second verification mode, the first node verifies the first packet based on the token corresponding to the packet forwarding path in the first data table.

[0136] In the first verification mode, if the verification result of the first message meets at least one of the following conditions, the first message is considered an illegal message and is discarded:

[0137] The first message did not carry a token;

[0138] The first message carries the first token, and the first token does not exist in the first data table;

[0139] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message at the first node;

[0140] The first message carries a first token, the first token exists in the first data table, and the first next-hop address does not match the second next-hop address; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0141] For example, in the first verification mode, the first node checks whether the first message carries a token. If the first message does not carry a token, the first message is discarded.

[0142] If the first message carries a token, the first node extracts the first token from the first message, and extracts the second ingress interface number and / or the second next-hop address from the first message, wherein, for example... Figure 5 As shown, the second next-hop address can be determined based on the SL carried in the first message and the segment list in the first message. The SL is used to indicate the currently active segment. The first node obtains the currently active SID from the SL, and determines the next-hop SID from the segment list in the first message based on the currently active SID.

[0143] The first node queries the first token in the first data table; if the first token is not found in the first data table, the first message is discarded. If the first token is found in the first data table, the first information indexed by the first token is determined in the first data table, and the ingress interface number and / or the next-hop address are obtained from the determined first information, thus obtaining the first ingress interface number and / or the first next-hop address; the first ingress interface number is compared with the second ingress interface number, and / or the first next-hop address is compared with the second next-hop address; if the comparison result indicates that the first ingress interface number and the second ingress interface number do not match (are different), and / or if the comparison result indicates that the first next-hop address and the second next-hop address do not match, the first message is discarded.

[0144] If the first message carries the first token, the first token exists in the first data table, and the first ingress interface number matches the second ingress interface number, and / or the first next-hop address matches the second next-hop address, then the first message is a valid message, and the first node forwards the first message based on the first next-hop address or the second next-hop address.

[0145] Figure 6 The diagram illustrates a message forwarding method according to an embodiment of this application. Figure 6 Based on relevant technologies, the message verification process shown in the dashed box has been added. In practical applications, such as... Figure 6 As shown in the dashed box, the first node extracts the first token and next-hop address (NH SID) from the SRH in the first message, extracts the ingress interface number (IngIF) from the first message, and queries the first token in the first data table; if the first token is not found in the first data table, the first message is discarded; if the first token is found in the first data table, the IngIF and NH SID in the first information indexed by the first token are obtained from the first data table.

[0146] If the IngIF obtained from the first data table is different from the IngIF in the first message, and / or the NH SID obtained from the first data table is different from the NH SID in the first message, the first message is discarded. If the IngIF obtained from the first data table is the same as the IngIF in the first message, and the NH SID obtained from the first data table is the same as the NH SID in the first message, the first message is forwarded based on the NH SID of the first message.

[0147] In the second verification mode, if the verification result of the first message meets at least one of the following conditions, the first message is considered an illegal message and is discarded:

[0148] The first message did not carry a token;

[0149] The first message carries the first token, and the first token does not exist in the first data table.

[0150] For example, in the second verification mode, the first node checks whether the first packet carries a token. If the first packet does not carry a token, it discards the first packet. If the first packet carries a token, it extracts the first token from the first packet and queries the first data table for the first token. If the first token is not found in the first data table, it discards the first packet. If the first token is found in the first data table, it forwards the first packet based on the second next-hop address in the first packet.

[0151] Before verifying the next-hop address in the first packet, the first node needs to obtain the next-hop address of the first packet from the first data table. Based on this, in one embodiment, the method further includes:

[0152] Based on the first token carried in the first message, the next-hop address of the first message is determined in the first data table; wherein,

[0153] The next-hop address of the first message is the next-hop address in the first information indexed by the first token.

[0154] Here, the first node extracts the first token from the first message, queries the first information corresponding to the first token in the first data table based on the first token, and determines the next-hop address from the queried first information to obtain the next-hop address of the first message.

[0155] In one embodiment, the first token is obtained by mapping the segment list of the first message.

[0156] Here, the message forwarding path of the first message is a segment list, and the first token is a hash value calculated based on the segment list of the first message, or the first token is a random number assigned to the segment list of the first message.

[0157] In one embodiment, the first token carried by the first message is encapsulated in the SRH of the first message.

[0158] Here, the first node extracts the first token from the SRH of the first message.

[0159] The data in the first data table is dynamically updated. Based on this, in one embodiment, the method further includes:

[0160] Receive the second information sent by the BGP device; the second information includes the second token and the segment list of the second message;

[0161] Write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

[0162] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0163] Here, BGP devices include SD-WAN controllers and / or cloud private network controllers. In practical applications, when the first node is a PE device or a PoP, the BGP device is a cloud private network controller.

[0164] The first node receives the second information sent by the BGP device, and based on the segment list of the second packet contained in the second information, determines the first information corresponding to the packet forwarding path of the second packet; and writes the first information corresponding to the packet forwarding path of the second packet into the first data table. The first information includes at least the second token, and may also include the ingress interface number and / or next-hop address corresponding to the packet forwarding path of the second packet at the first node.

[0165] It should be noted that the first information corresponding to the packet forwarding path of the first packet in the first data table is also determined based on the first token issued by the BGP device and the segment list of the first packet.

[0166] Correspondingly, embodiments of this application also provide a message verification method applied to a CPE. (Refer to...) Figure 7 The method includes:

[0167] Step 701: Send the first message to the first node.

[0168] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0169] Here, the CPE encapsulates the first message and sends the first message to the first node.

[0170] For example, the method for CPE to encapsulate the first message can be as follows: CPE receives the first token and the source path (SR Policy) of the first message issued by the BGP device (e.g., SD-WAN controller), the SR Policy including the segment list of the first message; and encapsulates the first message based on the first token and the segment list of the first message.

[0171] In one embodiment, the first information includes at least one of the following:

[0172] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0173] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0174] In one embodiment, the first message carries at least a first token, and also carries a second ingress interface number and / or SL; wherein,

[0175] The second ingress interface number represents the ingress interface number of the first message at the first node;

[0176] The SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address of the first message at the first node.

[0177] Since the SL is used to indicate the currently active segment, the first node can determine the second next-hop address based on the SL and segment list carried in the first message.

[0178] In one embodiment, the first token is obtained by mapping the segment list of the first message.

[0179] In one embodiment, the first token is encapsulated in the SRH of the first message.

[0180] Correspondingly, in order to update the data in the first data table, this application embodiment also provides a message verification method, which is applied to a BGP device, wherein the BGP device is an SD-WAN controller or a cloud private network controller.

[0181] Reference Figure 8 The method includes:

[0182] Step 801: Send the second information to the first node.

[0183] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table.

[0184] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0185] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0186] Here, the BGP device determines the second information and sends it to the first node. The first data table is used by the first node to verify the validity of the received messages.

[0187] In one embodiment, the first node includes a PE device and / or a PoP.

[0188] In one embodiment, the first information includes one of the following:

[0189] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0190] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0191] In one embodiment, the method further includes:

[0192] The second information is sent to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

[0193] Here, the BGP device sends a second message to the CPE so that the CPE can encapsulate the second message based on the second token and the segment list of the second message.

[0194] The embodiments of this application will be further described below with reference to the interactive flow diagram.

[0195] Figure 9 The message verification method shown includes:

[0196] Step 1: The CPE sends the first message to the first node.

[0197] The first node includes a PE device or a PoP. The CPE can send the first message directly or indirectly to the first node. For example, ... Figure 5 As shown, the CPE sends the first message directly to the PE device, or the CPE sends the first message to the PoP through the PE device.

[0198] In one embodiment, the first message carries at least a first token, and also carries a second ingress interface number and / or SL; wherein,

[0199] The second ingress interface number represents the ingress interface number of the first message at the first node;

[0200] SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address corresponding to the first message at the first node.

[0201] The first token is obtained by mapping the segment list of the first message; the first token is encapsulated in the SRH of the first message.

[0202] Step 2: The first node verifies the first message based on the first data table.

[0203] The first data table uses the token as an index and stores the first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0204] In one embodiment, the first information includes at least one of the following:

[0205] The corresponding message forwarding path is the ingress interface number of the first node;

[0206] The corresponding message forwarding path is the next-hop address of the first node.

[0207] Here, as Figure 5 As shown, the token and the corresponding first information are associated and stored in the first data table.

[0208] In one embodiment, the first node discards the first message if the verification result of the first message meets at least one of the following conditions:

[0209] The first message did not carry a token;

[0210] The first message carries the first token, and the first token does not exist in the first data table;

[0211] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number of the first message corresponding to the first node;

[0212] The first message carries a first token, the first token exists in the first data table, and the first next-hop address does not match the second next-hop address; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0213] The first token is obtained by mapping the segment list of the first message. The first token carried by the first message is encapsulated in the SRH of the first message.

[0214] It should be noted that the implementation process of step 2 is described in step 401, and will not be repeated here.

[0215] In one embodiment, the first node further determines the next-hop address of the first message in a first data table based on the first token carried in the first message. The next-hop address of the first message is the next-hop address in the first information indexed by the first token.

[0216] Step 3: The BGP device sends the second information to the first node.

[0217] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table; the first information corresponding to the message forwarding path of the second message is indexed by the second token in the first data table; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0218] Step 4: The first node receives the second information sent by the BGP device.

[0219] Step 5: The first node writes the first information corresponding to the message forwarding path of the second message into the first data table.

[0220] In this context, the first information corresponding to the message forwarding path of the second message is indexed by the second token in the first data table; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0221] Step 6: The BGP device sends the second information to the CPE.

[0222] The second information includes the second token and the segment list of the second message.

[0223] Step 7: The CPE receives the second information and encapsulates the second message based on the second information.

[0224] Step 8: The CPE sends the second message to the first node.

[0225] Step 9: The first node verifies the second message based on the first data table.

[0226] Here, the method by which the first node verifies the second message is similar to the method by which it verifies the first message, and will not be described in detail here.

[0227] The first node discards the second message if the verification result of the second message meets at least one of the following conditions:

[0228] The second message did not carry a token;

[0229] The second message carries a second token, and the second token does not exist in the first data table;

[0230] The second message carries a second token, the second token exists in the first data table, and the third and fourth ingress interface numbers do not match; the third ingress interface number represents the ingress interface number in the first information indexed by the second token; the fourth ingress interface number represents the ingress interface number of the second message corresponding to the first node;

[0231] The second message carries a second token, the second token exists in the first data table, and the third next-hop address does not match the fourth next-hop address; the third next-hop address represents the next-hop address in the first information indexed by the second token; the fourth next-hop address represents the next-hop address of the second message corresponding to the first node.

[0232] The second token is obtained by mapping the segment list of the second message. The second token carried by the second message is encapsulated in the SRH of the second message.

[0233] In the message verification method, apparatus, related devices, and storage medium provided in this application embodiment, the CPE sends a first message to a first node, and the first node verifies the first message based on a first data table. The first data table, indexed by a token, stores first information corresponding to each message forwarding path in at least one message forwarding path. The token is obtained by mapping the corresponding message forwarding path. In this scheme, each first node can verify the legality of the received first message based on the first data table, thereby reducing network security risks. Furthermore, the first data table, indexed by a token, reduces maintenance difficulty. The first node can query the first information corresponding to each forwarding path in the first data table based on the token, without needing to use the SID to retrieve or compare path information, reducing computational load and saving query time, thus reducing hardware deployment difficulty.

[0234] To implement the message verification method of this application embodiment, this application embodiment also provides a message verification device, which is set on the first node, such as... Figure 10 As shown, the device includes:

[0235] Verification unit 101 is used to verify the first message based on the first data table; wherein,

[0236] The first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path.

[0237] In one embodiment, the first information includes at least one of the following:

[0238] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0239] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0240] In one embodiment, the device further includes:

[0241] The discarding unit is configured to discard the first message if the verification result of the first message meets at least one of the following conditions:

[0242] The first message did not carry a token;

[0243] The first message carries a first token, and the first token does not exist in the first data table;

[0244] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message in the first node;

[0245] The first message carries a first token, the first token exists in the first data table, and the first next-hop address and the second next-hop address do not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0246] In one embodiment, the device further includes:

[0247] The first determining unit is configured to determine the next-hop address of the first message in the first data table based on the first token carried by the first message; wherein the next-hop address of the first message is the next-hop address in the first information indexed by the first token.

[0248] In one embodiment, the first token is obtained by mapping the segment list of the first message.

[0249] In one embodiment, the first token carried by the first message is encapsulated in the SRH of the first message.

[0250] In one embodiment, the device further includes:

[0251] The first receiving unit is used to receive the second information sent by the BGP device; the second information includes the second token and the segment list of the second message;

[0252] The writing unit is used to write the first information corresponding to the message forwarding path of the second message into the first data table; wherein,

[0253] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0254] In one embodiment, the first node includes providing a PE device and / or a PoP.

[0255] In practical applications, the first receiving unit can be implemented by the processor in the message verification device in combination with the communication interface, and the verification unit 101, the discarding unit, the first determining unit and the writing unit can be implemented by the processor of the message verification device.

[0256] It should be noted that the message verification device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiment on the first node side belong to the same concept. For details of the specific implementation process, please refer to the method embodiment, which will not be repeated here.

[0257] To implement the message verification method of this application embodiment, this application embodiment also provides a message verification device, which is installed on the CPE, such as... Figure 11 As shown, the device includes:

[0258] The first sending unit 111 is used to send a first message to the first node; wherein...

[0259] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0260] In one embodiment, the first information includes at least one of the following:

[0261] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0262] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0263] In one embodiment, the first message carries at least a first token, and also carries a second ingress interface number and / or SL; wherein,

[0264] The second ingress interface number represents the ingress interface number of the first message at the first node;

[0265] The SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address of the first message at the first node.

[0266] In one embodiment, the first token is encapsulated in the SRH of the first message.

[0267] In practical applications, the first sending unit 111 can be implemented by the processor in the message verification device combined with the communication interface.

[0268] It should be noted that the message verification device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiments on the CPE side belong to the same concept. For details of the specific implementation process, please refer to the method embodiments, which will not be repeated here.

[0269] To implement the message verification method of this application embodiment, this application embodiment also provides a message verification device, which is installed on a BGP device, such as an SD-WAN controller or a cloud private network controller. Figure 12 As shown, the device includes:

[0270] The second sending unit 121 is used to send second information to the first node; wherein...

[0271] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table;

[0272] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0273] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0274] In one embodiment, the first information includes one of the following:

[0275] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0276] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0277] In one embodiment, the second sending unit 121 is further configured to: send the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

[0278] In one embodiment, the first node includes a PE device and / or a PoP.

[0279] In practical applications, the second sending unit 121 can be implemented by the processor in the message verification device combined with the communication interface.

[0280] It should be noted that the message verification device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the message verification device provided in the above embodiments and the message verification method embodiments on the BGP device side belong to the same concept. For details of the specific implementation process, please refer to the method embodiments, which will not be repeated here.

[0281] Based on the hardware implementation of the above program modules, and in order to implement the method on the first node side of the embodiments of this application, the embodiments of this application also provide a network device, such as... Figure 13 As shown, network device 13 includes:

[0282] The first communication interface 131 is capable of exchanging information with other network nodes;

[0283] The first processor 132 is connected to the first communication interface 131 to enable information interaction with other network nodes. When running a computer program, it executes the methods provided by one or more technical solutions on the first node side. The computer program is stored in the first memory 133.

[0284] Specifically, the first processor 132 is used to verify the first message based on the first data table; wherein,

[0285] The first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path.

[0286] In one embodiment, the first information includes at least one of the following:

[0287] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0288] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0289] In one embodiment, the first processor 132 is further configured to discard the first message if the verification result of the first message satisfies at least one of the following conditions:

[0290] The first message did not carry a token;

[0291] The first message carries a first token, and the first token does not exist in the first data table;

[0292] The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message in the first node;

[0293] The first message carries a first token, the first token exists in the first data table, and the first next-hop address and the second next-hop address do not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

[0294] In one embodiment, the first processor 132 is further configured to: determine the next-hop address of the first message in the first data table based on the first token carried by the first message; wherein the next-hop address of the first message is the next-hop address in the first information indexed by the first token.

[0295] In one embodiment, the first token is obtained by mapping the segment list of the first message.

[0296] In one embodiment, the first token carried by the first message is encapsulated in the SRH of the first message.

[0297] In one embodiment, the first communication interface 131 is used to receive second information sent by the BGP device; the second information includes a second token and a segment list of the second message.

[0298] The first processor 132 is further configured to: write the first information corresponding to the message forwarding path of the second message into the first data table; wherein the first information corresponding to the message forwarding path of the second message is indexed in the first data table by the second token; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0299] In one embodiment, the first node includes providing a PE device and / or a PoP.

[0300] It should be noted that the specific processing procedures of the first processor 132 and the first communication interface 131 can be understood by referring to the above method.

[0301] Of course, in practical applications, the various components in network device 13 are coupled together through bus system 134. It can be understood that bus system 134 is used to implement communication between these components. In addition to a data bus, bus system 134 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 13 The general labeled all buses as Bus System 134.

[0302] The first memory 133 in this embodiment is used to store various types of data to support the operation of the network device 13. Examples of such data include any computer program used to operate on the network device 13.

[0303] The methods disclosed in the above embodiments of this application can be applied to the first processor 132, or implemented by the first processor 132. The first processor 132 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 132. The first processor 132 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 132 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 133. The first processor 132 reads the information in the first memory 133 and completes the steps of the aforementioned method in combination with its hardware.

[0304] In an exemplary embodiment, the network device 13 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0305] Based on the hardware implementation of the above program modules, and in order to implement the CPE-side method of this application embodiment, this application embodiment also provides a client terminal device, such as... Figure 14 As shown, the client terminal device 14 includes:

[0306] The second communication interface 141 is capable of exchanging information with other network nodes;

[0307] The second processor 142 is connected to the second communication interface 141 to enable information interaction with other network nodes. When running a computer program, it executes the methods provided by one or more technical solutions on the CPE side. The computer program is stored in the second memory 143.

[0308] Specifically, the second communication interface 141 is used to send a first message to the first node; wherein,

[0309] The first node includes a PE device or a PoP, used to verify the first message based on a first data table; the first data table uses a token as an index and stores first information corresponding to each message forwarding path in at least one message forwarding path; the token is obtained based on the mapping of the corresponding message forwarding path.

[0310] In one embodiment, the first information includes at least one of the following:

[0311] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0312] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0313] In one embodiment, the first message carries at least a first token, and also carries a second ingress interface number and / or SL; wherein,

[0314] The second ingress interface number represents the ingress interface number of the first message at the first node;

[0315] The SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address of the first message at the first node.

[0316] In one embodiment, the first token is encapsulated in the SRH of the first message.

[0317] It should be noted that the specific processing procedures of the second processor 142 and the second communication interface 141 can be understood by referring to the above method.

[0318] Of course, in practical applications, the various components in the client terminal device 14 are coupled together through the bus system 144. It can be understood that the bus system 144 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 144 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 14 The general labeled all buses as Bus System 144.

[0319] The second memory 143 in this embodiment is used to store various types of data to support the operation of the client terminal device 14. Examples of such data include any computer program used to operate on the client terminal device 14.

[0320] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the second processor 142. The second processor 142 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the form of software within the second processor 142. The second processor 142 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 142 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a second memory 143. The second processor 142 reads information from the second memory 143 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0321] In an exemplary embodiment, the client terminal device 14 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0322] Based on the hardware implementation of the above program modules, and in order to implement the BGP device-side method of this application embodiment, this application embodiment also provides a network device, such as... Figure 15 As shown, the network device 15 includes:

[0323] The third communication interface 151 is capable of exchanging information with other network nodes;

[0324] The third processor 152 is connected to the third communication interface 151 to enable information interaction with other network nodes. When running a computer program, it executes the methods provided by one or more technical solutions on the BGP device side. The computer program is stored on the third memory 153.

[0325] Specifically, the third communication interface 151 is used to send the second information to the first node; wherein,

[0326] The second information includes the second token and the segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into the first data table;

[0327] The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path;

[0328] The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

[0329] In one embodiment, the first information includes one of the following:

[0330] The corresponding message forwarding path is at the ingress interface number corresponding to the first node;

[0331] The corresponding message forwarding path is at the next-hop address corresponding to the first node.

[0332] In one embodiment, the third communication interface 151 is further configured to: send the second information to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

[0333] In one embodiment, the first node includes a PE device and / or a PoP.

[0334] It should be noted that the specific processing procedures of the third processor 152 and the third communication interface 151 can be understood by referring to the above method.

[0335] Of course, in practical applications, the various components in network device 15 are coupled together through bus system 154. It can be understood that bus system 154 is used to implement communication between these components. In addition to a data bus, bus system 154 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 15 The general labeled all buses as Bus System 154.

[0336] The third memory 153 in this embodiment is used to store various types of data to support the operation of the network device 15. Examples of such data include any computer programs used to operate on the network device 15.

[0337] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the third processor 152. The third processor 152 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the software form of the third processor 152. The third processor 152 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The third processor 152 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a third memory 153. The third processor 152 reads information from the third memory 153 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0338] In an exemplary embodiment, network device 15 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0339] It is understood that the memories (first memory 133, second memory 143, and third memory 153) in the embodiments of this application can be volatile memories or non-volatile memories, or both. Non-volatile memories can be read-only memories (ROM), programmable read-only memories (PROM), erasable programmable read-only memories (EPROM), electrically erasable programmable read-only memories (EEPROM), magnetic random access memories (FRAM), flash memories, magnetic surface memories, optical discs, or compact disc read-only memories (CD-ROM); magnetic surface memories can be disk storage or magnetic tape storage. Volatile memories can be random access memories (RAM), which are used as external caches. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0340] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium. For example, it may include a first memory 133 storing a computer program, which can be executed by a first processor 132 of a network device 13 to complete the steps described in the aforementioned first node-side method. Another example is a second memory 143 storing a computer program, which can be executed by a second processor 142 of a client terminal device 14 to complete the steps described in the aforementioned CPE-side method. Yet another example is a third memory 153 storing a computer program, which can be executed by a third processor 152 of a network device 15 to complete the steps described in the aforementioned BGP device-side method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0341] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0342] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0343] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0344] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A message verification method, characterized in that, Applied to the first node, the method includes: Based on the first data table, verify the first message; where... The first data table uses a token as an index to store first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path at the first node and the next-hop address of the corresponding packet forwarding path at the first node.

2. The method according to claim 1, characterized in that, The method further includes: The first message is discarded if the verification result of the first message meets at least one of the following conditions: The first message did not carry a token; The first message carries a first token, and the first token does not exist in the first data table; The first message carries a first token, the first token exists in the first data table, and the first ingress interface number does not match the second ingress interface number; the first ingress interface number represents the ingress interface number in the first information indexed by the first token; the second ingress interface number represents the ingress interface number corresponding to the first message in the first node; The first message carries a first token, the first token exists in the first data table, and the first next-hop address and the second next-hop address do not match; the first next-hop address represents the next-hop address in the first information indexed by the first token; the second next-hop address represents the next-hop address of the first message corresponding to the first node.

3. The method according to claim 1, characterized in that, The method further includes: Based on the first token carried in the first message, the next-hop address of the first message is determined in the first data table; wherein, The next-hop address of the first message is the next-hop address in the first information indexed by the first token.

4. The method according to claim 2 or 3, characterized in that, The first token is obtained by mapping the segment list of the first message.

5. The method according to claim 2 or 3, characterized in that, The first token carried in the first message is encapsulated in the segment routing header (SRH) of the first message.

6. The method according to claim 1, characterized in that, The method further includes: Receive second information from a Border Gateway Protocol (BGP) device; the second information includes a second token and a segment list of the second message; Write the first information corresponding to the message forwarding path of the second message into the first data table; wherein, The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

7. The method according to claim 1, characterized in that, The first node includes provider edge (PE) devices and / or point of access (PoP) devices.

8. A message verification method, characterized in that, The method, applied to Customer Premises Equipment (CPE), includes: Send the first message to the first node; among which, The first node includes a PE device or a PoP, used to verify the first packet based on a first data table; the first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the corresponding packet forwarding path mapping; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path in the first node and the next-hop address of the corresponding packet forwarding path in the first node.

9. The method according to claim 8, characterized in that, The first message carries at least a first token, and also carries a second ingress interface number and / or pointer SL; wherein, The second ingress interface number represents the ingress interface number of the first message at the first node; The SL is used by the first node to determine the second next-hop address; the second next-hop address represents the next-hop address of the first message at the first node.

10. The method according to claim 9, characterized in that, The first token is encapsulated in the SRH of the first message.

11. A message verification method, characterized in that, Applied to BGP devices, the method includes: Send the second message to the first node; among which, The second information includes a second token and a segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into a first data table; the first data table is used by the first node to verify the first message based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding message forwarding path in the first node and the next hop address of the corresponding message forwarding path in the first node. The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

12. The method according to claim 11, characterized in that, The method further includes: The second information is sent to the CPE; wherein the second information is used for the CPE to encapsulate the second message.

13. The method according to claim 11, characterized in that, The first node includes a PE device and / or a PoP.

14. A message verification device, characterized in that, include: The verification unit is used to verify the first message based on the first data table; wherein, The first data table uses a token as an index to store first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path at the first node and the next-hop address of the corresponding packet forwarding path at the first node.

15. A message verification device, characterized in that, include: The first sending unit is used to send a first message to the first node; wherein... The first node includes a PE device or a PoP, used to verify the first packet based on a first data table; the first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the corresponding packet forwarding path mapping; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path in the first node and the next-hop address of the corresponding packet forwarding path in the first node.

16. A message verification device, characterized in that, include: The second sending unit is used to send second information to the first node; wherein... The second information includes a second token and a segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into a first data table; the first data table is used by the first node to verify the first message based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding message forwarding path in the first node and the next hop address of the corresponding message forwarding path in the first node. The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

17. A network device, characterized in that, Includes a first processor and a first communication interface, wherein, The first processor is configured to verify the first message based on a first data table; wherein, The first data table uses a token as an index to store first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path at the first node and the next-hop address of the corresponding packet forwarding path at the first node.

18. A customer terminal device, characterized in that, Includes a second processor and a second communication interface, wherein, The second communication interface is used to send a first message to the first node; wherein, The first node includes a PE device or a PoP, used to verify the first packet based on a first data table; the first data table uses a token as an index and stores first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the corresponding packet forwarding path mapping; the verification of the first packet based on the first data table includes: verifying the first packet based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding packet forwarding path in the first node and the next-hop address of the corresponding packet forwarding path in the first node.

19. A network device, characterized in that, Including a third processor and a third communication interface, among which, The third communication interface is used to send second information to the first node; wherein... The second information includes a second token and a segment list of the second message; the second information is used by the first node to write the first information corresponding to the message forwarding path of the second message into a first data table; the first data table is used by the first node to verify the first message based on the token in the first data table and the first information indexed by the corresponding token; the first information includes the ingress interface number of the corresponding message forwarding path in the first node and the next hop address of the corresponding message forwarding path in the first node. The first data table uses a token as an index and stores the first information corresponding to each packet forwarding path in at least one packet forwarding path; the token is obtained based on the mapping of the corresponding packet forwarding path; The first information corresponding to the message forwarding path of the second message is indexed in the first data table using the second token as an index; the first information corresponding to the message forwarding path of the second message is determined by the segment list of the second message.

20. A network device, characterized in that, It includes a first processor and a first memory for storing computer programs that can run on the first processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 7.

21. A customer terminal device, characterized in that, It includes a second processor and a second memory for storing computer programs that can run on the second processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 8 to 10.

22. A network device, characterized in that, This includes a third processor and a third memory for storing computer programs that can run on the third processor. When the third processor runs the computer program, it performs the steps of the method described in any one of claims 11 to 13.

23. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7, or the steps of the method according to any one of claims 8 to 10, or the steps of the method according to any one of claims 11 to 13.

Images