SRv6 message transmission method, device, equipment and medium

Abstract

The present application discloses an SRv6 message transmission method, apparatus, device, and medium, which relates to the field of network security technology, including: a message sending end fills a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; a sending end input parameter containing the current first password is used to obtain a first message digest to obtain a target SRv6 message carrying the current first password; a next first password is obtained based on the current first password, and then the current first password is determined to be invalid; a message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message sent by the message receiving end; if the second message digest generated using the receiving end input parameter is the same as the first message digest, the target SRv6 message is determined to have passed verification, and the current second password is updated to obtain the next second password. This improves the network communication security of SRv6 message transmission.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an SRv6 message transmission method, apparatus, device, and medium. Background Art

[0002] The rapid development of cloud computing has led to the continuous growth of network scale and the widespread adoption of network applications. Network services and demands are also becoming increasingly extensive. Traditional IP / MPLS (Internet Protocol / Multiprotocol Label Switching) networks are gradually becoming unable to meet these demands. SRv6 (Segment Routing with IPv6), as a next-generation IPv6+ technology, allows programmability of network paths, services, and forwarding behaviors, supporting and satisfying a wide range of services and needs, and supporting the SDN (Software Defined Networking) architecture. SRv6 does not change the encapsulation structure of the original IPv6 packet, remaining an IPv6 packet. It offers excellent compatibility with existing networks and equipment, enabling rapid service rollout and smooth evolution.

[0003] Current SRv6 network security solutions primarily include two types: one based on ACL (Access Control List) traffic filtering, and the other based on HMAC (Hash-based Message Authentication Code, a message authentication code algorithm based on a hash function and a key) for message integrity verification. However, neither of these solutions can address the SRv6 replay attack. An SRv6 replay attack involves an attacker eavesdropping on messages between links and sending an SRv6 data packet that has already been received by the destination node, thereby deceiving the system. The attacker uses network monitoring or other methods to steal authentication credentials and maliciously or fraudulently repeats valid data transmissions. The destination node performs HMAC verification on a large number of replayed attack messages, which significantly consumes computing resources and prevents the effective processing of normal messages, seriously impacting the normal operation of network nodes.

[0004] In summary, how to improve the network communication security of SRv6 message transmission is a problem to be solved in this field. Summary of the Invention

[0005] In view of this, the present invention aims to provide a method, apparatus, device, and medium for transmitting SRv6 messages to improve the network communication security of SRv6 message transmission. The specific solution is as follows:

[0006] In a first aspect, the present application discloses an SRv6 message transmission method, which is applied to a message sending end and includes:

[0007] Filling the preset shared key into the first original SRv6 message to obtain a second original SRv6 message;

[0008] Determining a transmitter input parameter including the current first password;

[0009] Obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameter, and fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password;

[0010] obtaining a next first password based on the current first password, and then determining that the current first password is invalid;

[0011] The target SRv6 message is sent to a message receiving end, so that the message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameter. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message passes the verification, and the current second password is updated to obtain a next second password.

[0012] Optionally, determining the sending end input parameter including the current first password includes:

[0013] Determine the sender input parameters including the current first password, the source address of the message sender, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header;

[0014] Accordingly, the message receiving end obtains the receiving end input parameter based on the current second password and the target SRv6 message, including:

[0015] The message receiving end determines the current second password and the source address of the message sending end obtained from the target SRv6 message, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header as receiving end input parameters.

[0016] Optionally, determining the sending end input parameter including the current first password includes:

[0017] querying a first counting rule linked table library in the memory of the message sending end to determine whether a first target counting rule linked table corresponding to the hardware address of the message receiving end exists in the first counting rule linked table library and whether a password value stored at a target position in the first target counting rule linked table is not a default value;

[0018] If the first target counting rule chain table exists in the first counting rule chain table library and the password value stored at the target position in the first target counting rule chain table is not a default value, determining the password value as the current first password;

[0019] If the first target counting rule chain table does not exist in the first counting rule chain table library or the password value stored at the target position in the first target counting rule chain table is a default value, selecting a current first password from a plurality of preset magic numbers;

[0020] Determine a sending end input parameter including the current first password.

[0021] Optionally, the acquiring the receiving end input parameter based on the current second password and the target SRv6 message includes:

[0022] querying a second counting rule linked table library in the memory of the message receiving end, and determining whether the hardware address of the message sending end is contained in the second counting rule linked table library;

[0023] If the hardware address of the message sending end exists in the second counting rule linked table library, determining the second counting rule linked table corresponding to the hardware address of the message sending end from the second counting rule linked table library, and searching the second counting rule linked table for the current second password;

[0024] Acquire a receiving-end input parameter based on the current second password and the target SRv6 message.

[0025] Optionally, after determining whether the hardware address of the message sender exists in the second counting rule linked list library, the method further includes:

[0026] If the hardware address of the message sending end does not exist in the second counting rule linked table library, constructing a second counting rule linked table including the hardware address of the message sending end, the hardware address of the message receiving end, and a plurality of the preset magic numbers;

[0027] Determining each of the preset magic numbers as the current second password in sequence to obtain each receiving end input parameter, and generating each second message digest using the preset shared key, the preset HMAC algorithm, and each of the receiving end input parameters, and then sequentially matching each of the second message digests with the first message digest in the target SRv6 message;

[0028] If there is a second message digest that matches the first message digest, determining that the target SRv6 packet passes verification;

[0029] If the second message digest does not match the first message digest, it is determined that the target SRv6 message has failed verification, and a warning that the message sender has suffered a replay attack is reported to a preset management node.

[0030] Optionally, the filling the first message digest into the second original SRv6 message includes:

[0031] Determining a digest length of the first message digest, and determining whether the digest length is greater than a preset threshold;

[0032] If the digest length is not greater than the preset threshold, padding the preset low byte of the first message digest into the HMAC field in the HMAC TLV, and setting the preset high byte of the first message digest to 0;

[0033] If the digest length is greater than the preset threshold, the preset low byte of the first message digest is filled into the HMAC field in the HMAC TLV, and the preset high byte of the first message digest is filled into the Reserved field in the HMAC TLV.

[0034] In a second aspect, the present application discloses an SRv6 message transmission method, which is applied to a message receiving end, comprising:

[0035] Obtain a target SRv6 message generated and sent by a message sender; the process of the message sender generating the target SRv6 message includes: the message sender fills a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; determines a sender input parameter including a current first password; obtains a first message digest using the preset shared key, a preset HMAC algorithm, and the sender input parameter, and fills the first message digest into the second original SRv6 message to obtain the target SRv6 message carrying the current first password, and the message sender obtains a next first password based on the current first password, and then determines that the current first password is invalid;

[0036] Obtaining a receiving-end input parameter based on the current second password and the target SRv6 message;

[0037] Generate a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameters;

[0038] If the first message digest and the second message digest in the target SRv6 message are the same, determining that the target SRv6 message passes verification;

[0039] The current second password is updated to obtain a next second password.

[0040] In a third aspect, the present application discloses an SRv6 message transmission device, which is applied to a message sending end and includes:

[0041] An information filling module, configured to fill a preset shared key into the first original SRv6 message to obtain a second original SRv6 message;

[0042] A parameter determination module, configured to determine a sending end input parameter including a current first password;

[0043] a message acquisition module, configured to obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameter, and to fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password;

[0044] a password updating module, configured to obtain a next first password based on the current first password, and then determine that the current first password is invalid;

[0045] A message verification module is used to send the target SRv6 message to a message receiving end, so that the message receiving end obtains the receiving end input parameters based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm and the receiving end input parameters. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message has passed the verification, and the current second password is updated to obtain the next second password.

[0046] In a fourth aspect, the present application discloses an electronic device, comprising:

[0047] Memory, used to store computer programs;

[0048] A processor is configured to execute the computer program to implement the steps of the aforementioned disclosed SRv6 message transmission method.

[0049] In a fifth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed SRv6 message transmission method are implemented.

[0050] In a sixth aspect, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the aforementioned disclosed SRv6 message transmission method.

[0051] The beneficial effects of the present application are as follows: the present application is applied to a message sending end, filling a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; determining a sending end input parameter containing a current first password; obtaining a first message digest using the preset shared key, a preset HMAC algorithm, and the sending end input parameter, and filling the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password; obtaining a next first password based on the current first password, and then determining that the current first password is invalid; sending the target SRv6 message to a message receiving end, so that the message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameter; if the first message digest and the second message digest in the target SRv6 message are the same, determining that the target SRv6 message passes verification, and updating the current second password to obtain a next second password. It can be seen that after the message sender of this application generates a target SRv6 message carrying the current first password, it obtains the next first password based on the current first password, and then determines that the current first password is invalid. That is to say, the first message digest contained in the target SRv6 message obtained is generated based on the one-time password. Then, when the message receiver receives the target SRv6 message, it obtains the receiving end input parameters based on the current second password and the target SRv6 message, and then uses the receiving end input parameters to generate the second message digest. If the first message digest and the second message digest are the same, it means that the target SRv6 message is invalid. The v6 message has not been tampered with during transmission, that is, it has not been subjected to a replay attack. Similarly, if the first message digest and the second message digest are different, it means that the target SRv6 message has been subjected to a replay attack during transmission. In this case, there is no need to continuously verify it later, thus avoiding the waste of computing resources. In other words, this application determines whether the SRv6 message has been subjected to a replay attack during transmission based on the one-time password, so that the attacker cannot simulate the password and therefore cannot hide the behavior of illegally tampering with the message. It can then accurately determine whether it has been subjected to a replay attack, thereby improving the network communication security of SRv6 message transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0053] Figure 1 This is a flow chart of an SRv6 message transmission method disclosed in this application;

[0054] Figure 2 This is a schematic diagram of determining a specific sender password disclosed in this application;

[0055] Figure 3 A schematic diagram of generating a specific target SRv6 message disclosed in this application;

[0056] Figure 4 A specific message receiving end verification flow chart disclosed in this application;

[0057] Figure 5 This is a flow chart of another SRv6 message transmission method disclosed in this application;

[0058] Figure 6 This is a structural diagram of an SRv6 message transmission device disclosed in this application;

[0059] Figure 7 This is a structural diagram of an electronic device disclosed in this application.

[0060] Figure 8 This is a schematic diagram of the implementation principle of a computer program product disclosed in this application. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0062] Current SRv6 network security solutions primarily include two approaches: ACL-based traffic filtering and HMAC-based message integrity verification. However, neither approach addresses SRv6 replay attacks. An SRv6 replay attack involves an attacker eavesdropping on messages between links and sending an SRv6 packet that has already been received by the destination node, thereby deceiving the system. By using network monitoring or other methods to steal authentication credentials, the attacker maliciously or fraudulently repeats valid data transmissions. The destination node performs HMAC verification on a large number of replayed attack messages, significantly consuming computing resources and preventing legitimate messages from being effectively processed, severely impacting the normal operation of network nodes.

[0063] To this end, this application provides an SRv6 message transmission solution to improve the network communication security of SRv6 message transmission.

[0064] See also Figure 1 As shown, the embodiment of the present application discloses an SRv6 message transmission method, which is applied to a message sending end, including:

[0065] Step S11: Fill the preset shared key into the first original SRv6 message to obtain a second original SRv6 message.

[0066] The message sender and the message receiver specify a same preset shared key K and preset HMAC algorithm HMAC_Algorithm through verbal negotiation. The message sender fills the preset shared key K into the HMAC Key ID field of the HMACTLV of the first original SRv6 message.

[0067] Step S12: Determine the sending end input parameters including the current first password.

[0068] In this embodiment, determining the sender input parameters including the current first password includes: determining the sender input parameters including the current first password, the source address of the message sender, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header. The sender input parameter Input_Para1 is specifically as follows:

[0069] 1) Current first password (COUNT);

[0070] 2) Source IPv6 address (Src_IPv6);

[0071] 3) The last entry in the Segment Routing Header (SRH) (Last_Entry);

[0072] 4) Flag bit;

[0073] 5) HMAC length (Length);

[0074] 6) HMAC key information (Key_ID);

[0075] 7) All address information in SRH (All_Address).

[0076] In this embodiment, the determination of the input parameters of the sending end including the current first password includes: querying the first counting rule linked table library in the memory of the message sending end, judging whether there is a first target counting rule linked table corresponding to the hardware address of the message receiving end in the first counting rule linked table library and the password value stored at the target position in the first target counting rule linked table is not the default value; if the first target counting rule linked table exists in the first counting rule linked table library and the password value stored at the target position in the first target counting rule linked table is not the default value, then determining the password value as the current first password; if the first target counting rule linked table does not exist in the first counting rule linked table library or the password value stored at the target position in the first target counting rule linked table is the default value, then selecting the current first password from a plurality of preset magic numbers; determining the input parameters of the sending end including the current first password. For example Figure 2 A specific schematic diagram of determining the sender's password is shown, and the specific process of determining the current first password is as follows:

[0077] 1) Query the first counting rule linked list library in the memory of the message sending end;

[0078] 2) If a first target counting rule linked list corresponding to the hardware address of the message receiving end exists in the first counting rule linked list library, and the password value stored at the target position (X) in the first target counting rule linked list is the default value (for example, 0xFFFF), it indicates that the message sending end has just started or restarted. In other words, the communicating parties have not specified a counting rule. Next, the current first password is selected from multiple preset magic numbers, such as magic number 1, magic number 2, magic number 3, magic number 4, and magic number 5, and selected as the starting count. Once the sender specifies a magic number, the magic number is copied to the current first password and used as an input parameter.

[0079] 3) If the first target counting rule linked list corresponding to the hardware address of the message receiving end does not exist in the first counting rule linked list library, the MAC addresses of the communicating parties and the negotiated magic number are added to the counting linked list library. For example, the nodes added are: first network element MAC, second network element MAC, X (i.e., target location), magic number 1, magic number 2, magic number 3, magic number 4, magic number 5. One of the magic numbers 1, 2, 3, 4, and 5 is selected as the starting count. Once the sender specifies a magic number, the magic number is copied to X. That is, the current first password is selected from multiple preset magic numbers and used as the input parameter.

[0080] 4) If the first target counting rule chain table exists in the first counting rule chain table library and the password value Count stored at the target position in the first target counting rule chain table is not the default value, it indicates that the two parties are already communicating normally. At this time, the password value Count is determined as the current first password, and COUNT is used as the input parameter.

[0081] Step S13: Obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameters, and fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password.

[0082] The first message digest Digest1 is obtained using the preset shared key K, the preset HMAC algorithm HMAC_Algorithm, and the sender input parameter Input_Para1. The calculation formula is as follows:

[0083] Digest=HMAC_Algorithm(K, Input_Para).

[0084] In this embodiment, the filling of the first message digest into the second original SRv6 message includes: determining the digest length of the first message digest, and judging whether the digest length is greater than a preset threshold; if the digest length is not greater than the preset threshold, filling the preset low byte of the first message digest into the HMAC field in the HMAC TLV, and setting the preset high byte of the first message digest to 0; if the digest length is greater than the preset threshold, filling the preset low byte of the first message digest into the HMAC field in the HMAC TLV, and filling the preset high byte of the first message digest into the Reserved field in the HMAC TLV. For example Figure 3A specific target SRv6 message generation schematic diagram is shown. If the length of Digest1 is not greater than a preset threshold, for example, not greater than 32 bytes, the preset low byte of the first message digest is filled into the HMAC field in the HMAC TLV of the second original SRv6 message, and the preset high byte of the first message digest is set to 0; if the length of Digest1 is greater than 32 bytes, the preset low byte of the first message digest is filled into the HMAC field in the HMAC TLV, and the preset high byte of the first message digest is filled into the Reserved field in the HMAC TLV.

[0085] Step S14: obtaining a next first password based on the current first password, and then determining whether the current first password is invalid.

[0086] The current first password is updated. For example, if the current first password is the magic number 2, then the current first password is added by 1 to obtain the next first password. For example, the next first password is the magic number 3. Then, the magic number 2 is determined to be invalid. That is, the next first password cannot use the magic number 2. It can be understood that after the first password is updated, the first target counting rule linked list of the message sending end also needs to be updated. For example, the message sending end and the message receiving end are the first network element node and the second network element node respectively. Before the update, the first target counting rule linked list is (first network element node MAC, second network element node MAC, magic number 2; magic number 1, magic number 2, magic number 3, magic number 4, magic number 5). After the update, the first target counting rule linked list is (first network element node MAC, second network element node MAC, magic number 3; magic number 1, magic number 2, magic number 3, magic number 4, magic number 5).

[0087] Step S15: Send the target SRv6 message to the message receiving end, so that the message receiving end obtains the receiving end input parameters based on the current second password and the target SRv6 message, and uses the preset shared key, the preset HMAC algorithm and the receiving end input parameters to generate a second message digest. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message passes the verification, and the current second password is updated to obtain the next second password.

[0088] In this embodiment, the message receiving end obtains receiving end input parameters based on the current second password and the target SRv6 message, including: the message receiving end determines the current second password and the source address of the message sending end obtained from the target SRv6 message, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header as receiving end input parameters. After receiving the target SRv6 message, the message receiving end obtains the preset shared key K and preset HMAC algorithm HMAC_Algorithm negotiated with the message sending end in the target SRv6 message, and also needs to obtain the following parameters:

[0089] 1) Source IPv6 address (Src_IPv6);

[0090] 2) The last entry in the segment routing extension header (Last_Entry);

[0091] 3) Flag;

[0092] 4) HMAC length (Length);

[0093] 5) HMAC key information (Key_ID);

[0094] 6) All address information in SRH (All_Address);

[0095] The above parameters and the current second password constitute the receiving end input parameter Input_Para2.

[0096] The preset shared key K in the HMAC Key ID field and the preset HMAC algorithm HMAC_Algorithm are used in combination with Input_Para2 to calculate the second message digest Digest2. The specific formula is as follows:

[0097] Digest2=HMAC_Algorithm(K, Input_Para2).

[0098] In this embodiment, the acquisition of the receiving end input parameters based on the current second password and the target SRv6 message includes: querying the second counting rule linked table library in the memory of the message receiving end, and judging whether the hardware address of the message sending end exists in the second counting rule linked table library; if the hardware address of the message sending end exists in the second counting rule linked table library, determining the second counting rule linked table corresponding to the hardware address of the message sending end from the second counting rule linked table library, and querying the current second password in the second counting rule linked table; acquiring the receiving end input parameters based on the current second password and the target SRv6 message. For example Figure 4 A specific message receiving end verification flow chart shown in FIG. queries the second counting rule linked table library in the memory of the message receiving end (for example, the second network element MAC). If the hardware address of the message sending end is found in the second counting rule linked table library, for example, the first network element MAC, then the second counting rule linked table corresponding to the hardware address of the message sending end is determined from the second counting rule linked table library, for example, (first network element MAC, second network element MAC, current second password, magic number 1, magic number 2, magic number 3, magic number 4, magic number 5), and the current second password is used as the receiving end input parameter. It should be noted that the current first The password is the same as the current second password. In this way, the second message digest Digest2 calculated using the receiving end input parameter Input_Para2 containing the current second password should be the same as the first message digest Digest1. If they are different, it means that the message transmission has suffered a replay attack, and then the warning that the message sender has suffered a replay attack is reported to the preset management node, that is, reported to the administrator or controller, and then normal communication services are refused to be provided. This can effectively defend against SRv6 message replay attacks, thereby avoiding the exhaustion of memory resources of routing calculation nodes and improving the security of SRv6 network communications.

[0099] In this embodiment, after determining whether the hardware address of the message sender exists in the second counting rule linked list library, the method further includes: if the hardware address of the message sender does not exist in the second counting rule linked list library, constructing a second counting rule linked list including the hardware address of the message sender, the hardware address of the message receiver, and a plurality of preset magic numbers; sequentially determining each of the preset magic numbers as the current second password to obtain each receiver input parameter, generating each second message digest using the preset shared key, the preset HMAC algorithm, and each receiver input parameter, and then sequentially matching each of the second message digests with the first message digest in the target SRv6 message; if a second message digest matches the first message digest, determining that the target SRv6 message passes verification; if a second message digest does not match the first message digest, determining that the target SRv6 message fails verification, and reporting a warning to a preset management node that the message sender has suffered a replay attack.

[0100] like Figure 4 As shown, if the hardware address of the message sender does not exist in the second counting rule linked list library, then a second counting rule linked list is established. The second counting rule linked list is, for example, ((first network element MAC, second network element MAC, X: magic number 1, magic number 2, magic number 3, magic number 4, magic number 5), where X is the unknown current second password item. Then, magic number 1, magic number 2, magic number 3, magic number 4, and magic number 5 are used as the current second password in sequence. That is, the magic number 1, magic number 2, magic number 3, magic number 4, and magic number 5 are sequentially tried to be used to calculate the second message digest, that is, the second message digest 1, the second message digest 2, the second message digest 3, the second message digest 4, and the second message digest 5 can be obtained, and these five second message digests are matched with the first message digest in sequence. If these five second message digests are If there is a message digest identical to the first message digest among the five second message digests, the magic number corresponding to the message digest is determined as the current second password, and the target SRv6 message is determined to have passed verification, indicating that the message transmission process has not been subject to a replay attack. The current second password is then updated to obtain the next second password. The method for updating the password at the message receiving end is the same as the method for updating the password at the message sending end. If there is a message digest identical to the first message digest among the five second message digests, the target SRv6 message is determined to have failed verification, indicating that the message transmission process has been subject to a replay attack. The warning that the message sending end has suffered a replay attack is then reported to the preset management node, which refuses to provide normal communication services to it. This means that there is no need to repeat the message verification work, effectively avoiding the waste of computing resources.

[0101] In this embodiment, each counting rule linked list library is established in memory. Compared with the traditional method of storing counting rules in memory, it can greatly save CPU resources and improve computing efficiency. Furthermore, traditional methods for preventing replay attacks, such as adding sequence numbers, timestamps, and random numbers, require adding message fields and are easy for attackers to find patterns. However, this embodiment can use the HMAC security mechanism before compatibility with SRv6 without adding or modifying message fields, effectively defending against replay attacks.

[0102] The beneficial effects of the present application are as follows: the present application is applied to a message sending end, filling a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; determining a sending end input parameter containing a current first password; obtaining a first message digest using the preset shared key, a preset HMAC algorithm, and the sending end input parameter, and filling the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password; obtaining a next first password based on the current first password, and then determining that the current first password is invalid; sending the target SRv6 message to a message receiving end, so that the message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameter; if the first message digest and the second message digest in the target SRv6 message are the same, determining that the target SRv6 message passes verification, and updating the current second password to obtain a next second password. It can be seen that after the message sender of this application generates a target SRv6 message carrying the current first password, it obtains the next first password based on the current first password, and then determines that the current first password is invalid. That is to say, the first message digest contained in the target SRv6 message obtained is generated based on the one-time password. Then, when the message receiver receives the target SRv6 message, it obtains the receiving end input parameters based on the current second password and the target SRv6 message, and then uses the receiving end input parameters to generate the second message digest. If the first message digest and the second message digest are the same, it means that the target SRv6 message is invalid. The v6 message has not been tampered with during transmission, that is, it has not been subjected to a replay attack. Similarly, if the first message digest and the second message digest are different, it means that the target SRv6 message has been subjected to a replay attack during transmission. In this case, there is no need to continuously verify it later, thus avoiding the waste of computing resources. In other words, this application determines whether the SRv6 message has been subjected to a replay attack during transmission based on the one-time password, so that the attacker cannot simulate the password and therefore cannot hide the behavior of illegally tampering with the message. It can then accurately determine whether it has been subjected to a replay attack, thereby improving the network communication security of SRv6 message transmission.

[0103] See also Figure 5 As shown, the embodiment of the present application discloses another SRv6 message transmission method, which is applied to a message receiving end, including:

[0104] Step S21: Obtain the target SRv6 message generated and sent by the message sender; the process of the message sender generating the target SRv6 message includes: the message sender fills the preset shared key into the first original SRv6 message to obtain the second original SRv6 message; determines the sender input parameter containing the current first password; uses the preset shared key, the preset HMAC algorithm and the sender input parameter to obtain a first message digest, and fills the first message digest into the second original SRv6 message to obtain the target SRv6 message carrying the current first password, and the message sender obtains the next first password based on the current first password, and then determines that the current first password is invalid.

[0105] Step S22: Acquire receiving-end input parameters based on the current second password and the target SRv6 message.

[0106] Step S23: Generate a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameters.

[0107] Step S24: If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message passes verification.

[0108] Step S25: Update the current second password to obtain a next second password.

[0109] This shows that traditional methods require adding message fields to add sequence numbers, timestamps, random numbers, etc., and attackers can easily find patterns. However, this embodiment can use the HMAC security mechanism before being compatible with SRv6 without adding or modifying message fields, which can effectively defend against replay attacks.

[0110] See also Figure 6 As shown, the embodiment of the present application discloses an SRv6 message transmission device, which is applied to a message sending end, including:

[0111] An information filling module 11 is configured to fill a preset shared key into the first original SRv6 message to obtain a second original SRv6 message;

[0112] A parameter determination module 12, configured to determine a sender input parameter including a current first password;

[0113] a message acquisition module 13, configured to obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameter, and to fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password;

[0114] a password updating module 14, configured to obtain a next first password based on the current first password, and then determine that the current first password is invalid;

[0115] The message verification module 15 is used to send the target SRv6 message to the message receiving end, so that the message receiving end obtains the receiving end input parameters based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm and the receiving end input parameters. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message has passed the verification, and the current second password is updated to obtain the next second password.

[0116] The beneficial effects of the present application are as follows: the present application is applied to a message sending end, filling a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; determining a sending end input parameter containing a current first password; obtaining a first message digest using the preset shared key, a preset HMAC algorithm, and the sending end input parameter, and filling the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password; obtaining a next first password based on the current first password, and then determining that the current first password is invalid; sending the target SRv6 message to a message receiving end, so that the message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameter; if the first message digest and the second message digest in the target SRv6 message are the same, determining that the target SRv6 message passes verification, and updating the current second password to obtain a next second password. It can be seen that after the message sender of this application generates a target SRv6 message carrying the current first password, it obtains the next first password based on the current first password, and then determines that the current first password is invalid. That is to say, the first message digest contained in the target SRv6 message obtained is generated based on the one-time password. Then, when the message receiver receives the target SRv6 message, it obtains the receiving end input parameters based on the current second password and the target SRv6 message, and then uses the receiving end input parameters to generate the second message digest. If the first message digest and the second message digest are the same, it means that the target SRv6 message is invalid. The v6 message has not been tampered with during transmission, that is, it has not been subjected to a replay attack. Similarly, if the first message digest and the second message digest are different, it means that the target SRv6 message has been subjected to a replay attack during transmission. In this case, there is no need to continuously verify it later, thus avoiding the waste of computing resources. In other words, this application determines whether the SRv6 message has been subjected to a replay attack during transmission based on the one-time password, so that the attacker cannot simulate the password and therefore cannot hide the behavior of illegally tampering with the message. It can then accurately determine whether it has been subjected to a replay attack, thereby improving the network communication security of SRv6 message transmission.

[0117] Furthermore, an embodiment of the present application also provides an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0118] Figure 7This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Specifically, the device may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the SRv6 message transmission method performed by the electronic device as disclosed in any of the aforementioned embodiments.

[0119] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0120] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0121] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0122] Among them, the operating system 221 is used to manage and control the various hardware devices and computer programs 222 on the electronic device to enable the processor 21 to calculate and process the massive data 223 in the memory 22. It can be Windows, Unix, Linux, etc. In addition to including computer programs that can be used to complete the SRv6 message transmission method performed by the electronic device disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks. In addition to including data transmitted by external devices received by the electronic device, the data 223 can also include data collected by its own input and output interface 25.

[0123] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned SRv6 message transmission method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0124] The present application also provides a computer program product, including a computer program and / or computer instructions, which, when executed by a processor, implement the steps of the above-mentioned SRv6 message transmission method. Figure 8 , Figure 8A schematic diagram of the implementation principle of a computer program product provided in an embodiment of the present application is provided. The computer program product includes a message filling instruction a, a parameter determination program b, a message acquisition program c, a password update program d, and a message verification program e. When the message filling instruction a is executed by the processor, the operation implemented is: filling a preset shared key into a first original SRv6 message to obtain a second original SRv6 message. When the parameter determination program b is executed by the processor, the operation implemented is: determining the sender input parameters containing the current first password. When the message acquisition program c is executed by the processor, the operation implemented is: using the preset shared key, the preset HMAC algorithm, and the sender input parameters to obtain a first message digest, and filling the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password. When the password update program d is executed by the processor, the operation implemented is: obtaining a next first password based on the current first password, and then determining that the current first password is invalid. When the message verification program e is executed by the processor, the operations implemented are: sending the target SRv6 message to the message receiving end, so that the message receiving end obtains the receiving end input parameters based on the current second password and the target SRv6 message, and uses the preset shared key, the preset HMAC algorithm and the receiving end input parameters to generate a second message digest; if the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message passes the verification, and the current second password is updated to obtain the next second password.

[0125] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0126] Professionals may further appreciate that the units and algorithmic steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable EPROM (Erasable Programmable Read Only Memory), electrically erasable programmable EEPROM (Electrically Erasable Programmable read only memory), registers, hard disk, removable disk, CD-ROM (CoMP24000287act Disc Read-Only Memory), or any other form of storage medium known in the technical field.

[0127] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0128] The above describes in detail the SRv6 message transmission method, apparatus, device, and medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art may vary in the specific implementation methods and application scope based on the concepts of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. A SRv6 message transmission method, characterized in that: Applicable to the message sending end, including: Filling the preset shared key into the first original SRv6 message to obtain a second original SRv6 message; Determining a transmitter input parameter including the current first password; Obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameter, and fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password; obtaining a next first password based on the current first password, and then determining that the current first password is invalid; The target SRv6 message is sent to a message receiving end, so that the message receiving end obtains a receiving end input parameter based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameter. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message passes the verification, and the current second password is updated to obtain a next second password.

2. The SRv6 message transmission method according to claim 1, characterized in that: The step of determining the sending end input parameter including the current first password includes: Determine the sender input parameters including the current first password, the source address of the message sender, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header; Accordingly, the message receiving end obtains the receiving end input parameter based on the current second password and the target SRv6 message, including: The message receiving end determines the current second password and the source address of the message sending end obtained from the target SRv6 message, the last entry data in the segment routing extension header, the flag bit, the HMAC length, the HMAC key information, and all address information in the segment routing extension header as receiving end input parameters.

3. The SRv6 message transmission method according to claim 1, wherein: The step of determining the sending end input parameter including the current first password includes: querying a first counting rule linked table library in the memory of the message sending end to determine whether a first target counting rule linked table corresponding to the hardware address of the message receiving end exists in the first counting rule linked table library and whether a password value stored at a target position in the first target counting rule linked table is not a default value; If the first target counting rule chain table exists in the first counting rule chain table library and the password value stored at the target position in the first target counting rule chain table is not a default value, determining the password value as the current first password; If the first target counting rule chain table does not exist in the first counting rule chain table library or the password value stored at the target position in the first target counting rule chain table is a default value, selecting a current first password from a plurality of preset magic numbers; Determine a sending end input parameter including the current first password.

4. The SRv6 message transmission method according to claim 3, characterized in that: The acquiring the receiving end input parameter based on the current second password and the target SRv6 message includes: querying a second counting rule linked table library in the memory of the message receiving end, and determining whether the hardware address of the message sending end is contained in the second counting rule linked table library; If the hardware address of the message sending end exists in the second counting rule linked table library, determining the second counting rule linked table corresponding to the hardware address of the message sending end from the second counting rule linked table library, and searching the second counting rule linked table for the current second password; Acquire a receiving-end input parameter based on the current second password and the target SRv6 message.

5. The SRv6 message transmission method according to claim 4, characterized in that: After determining whether the hardware address of the message sending end exists in the second counting rule linked list library, the method further includes: If the hardware address of the message sending end does not exist in the second counting rule linked table library, constructing a second counting rule linked table including the hardware address of the message sending end, the hardware address of the message receiving end, and a plurality of the preset magic numbers; Determining each of the preset magic numbers as the current second password in sequence to obtain each receiving end input parameter, and generating each second message digest using the preset shared key, the preset HMAC algorithm, and each of the receiving end input parameters, and then sequentially matching each of the second message digests with the first message digest in the target SRv6 message; If there is a second message digest that matches the first message digest, determining that the target SRv6 packet passes verification; If the second message digest does not match the first message digest, it is determined that the target SRv6 message has failed verification, and a warning that the message sender has suffered a replay attack is reported to a preset management node.

6. The SRv6 message transmission method according to any one of claims 1 to 5, characterized in that: The filling the first message digest into the second original SRv6 message includes: Determining a digest length of the first message digest, and determining whether the digest length is greater than a preset threshold; If the digest length is not greater than the preset threshold, padding the preset low byte of the first message digest into the HMAC field in the HMAC TLV, and setting the preset high byte of the first message digest to 0; If the digest length is greater than the preset threshold, the preset low byte of the first message digest is filled into the HMAC field in the HMACTLV, and the preset high byte of the first message digest is filled into the Reserved field in the HMAC TLV.

7. A SRv6 message transmission method, characterized in that: Applied to the message receiving end, including: Obtain a target SRv6 message generated and sent by a message sender; the process of the message sender generating the target SRv6 message includes: the message sender fills a preset shared key into a first original SRv6 message to obtain a second original SRv6 message; determines a sender input parameter including a current first password; obtains a first message digest using the preset shared key, a preset HMAC algorithm, and the sender input parameter, and fills the first message digest into the second original SRv6 message to obtain the target SRv6 message carrying the current first password, and the message sender obtains a next first password based on the current first password, and then determines that the current first password is invalid; Obtaining a receiving-end input parameter based on the current second password and the target SRv6 message; Generate a second message digest using the preset shared key, the preset HMAC algorithm, and the receiving end input parameters; If the first message digest and the second message digest in the target SRv6 message are the same, determining that the target SRv6 message passes verification; The current second password is updated to obtain a next second password.

8. An SRv6 message transmission device, characterized in that: Applicable to the message sending end, including: An information filling module, configured to fill a preset shared key into the first original SRv6 message to obtain a second original SRv6 message; A parameter determination module, configured to determine a sending end input parameter including a current first password; a message acquisition module, configured to obtain a first message digest using the preset shared key, the preset HMAC algorithm, and the sender input parameter, and to fill the first message digest into the second original SRv6 message to obtain a target SRv6 message carrying the current first password; a password updating module, configured to obtain a next first password based on the current first password, and then determine that the current first password is invalid; A message verification module is used to send the target SRv6 message to a message receiving end, so that the message receiving end obtains the receiving end input parameters based on the current second password and the target SRv6 message, and generates a second message digest using the preset shared key, the preset HMAC algorithm and the receiving end input parameters. If the first message digest and the second message digest in the target SRv6 message are the same, it is determined that the target SRv6 message has passed the verification, and the current second password is updated to obtain the next second password.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the SRv6 message transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the steps of the SRv6 message transmission method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the SRv6 message transmission method according to any one of claims 1 to 7 are implemented.

Images