Information processing methods, apparatus, equipment, storage media and computer program products

Abstract

This application discloses an information processing method, apparatus, device, storage medium, and computer program product. The method includes: a user boundary device acquiring a first Application Response Network (ARN) identifier; the first ARN identifier representing the application's call relationship to network capabilities and / or the network's open capabilities to the application; marking a first Internet Protocol (IP) packet based on the first ARN identifier to generate a second IP packet; and sending the second IP packet.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, and in particular to an information processing method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] Currently, to provide quality of service (QoS) assurance capabilities in Internet Protocol (IP) networks, technologies ranging from Multi Protocol Label Switching (MPLS) to Segment Routing over IPv6 (SRv6) all focus on providing network path scheduling capabilities. By planning network link resources, point-to-point network paths with different characteristics can be constructed, such as low latency and high bandwidth. When applications and network capabilities coordinate, existing solutions fall into several categories. The first category classifies traffic based on application characteristics and then directs different traffic to specific network paths. The second category involves applications explicitly carrying type information; network boundary service access point devices identify the application information explicitly carried in the packets and then map these packets to network tunnels / slices. The third category directly opens network connections for applications to access. However, all three methods suffer from poor network security. Summary of the Invention

[0003] In view of this, embodiments of this application aim to provide an information processing method, apparatus, device, storage medium, and computer program product.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides an information processing method applied to a user boundary device, the method comprising:

[0006] Obtain the identifier of the first application response network (ARN); the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application;

[0007] The first IP packet is marked based on the first ARN identifier, and a second IP packet is generated;

[0008] Send the second IP message.

[0009] Furthermore, according to at least one embodiment of this application, marking the first IP packet based on the first ARN identifier includes:

[0010] Write the first ARN identifier and the first information into the flow label field and traffic type field in the header of the first IP packet, respectively;

[0011] The first information is used to indicate whether the original content in the stream tag field is escaped into the first ARN identifier.

[0012] Furthermore, according to at least one embodiment of this application, marking the first IP packet based on the first ARN identifier includes:

[0013] Write the first ARN identifier into the extended header of the first IP packet;

[0014] or,

[0015] Write the first ARN identifier into the source address field of the header of the first IP packet.

[0016] Furthermore, according to at least one embodiment of this application, obtaining the first ARN identifier includes:

[0017] Obtain the first ARN identifier sent by the controller;

[0018] The first ARN identifier is assigned to the user boundary device by the controller based on user information, application information, and network service information.

[0019] Furthermore, according to at least one embodiment of this application, sending the second IP packet includes:

[0020] The first user information is carried in the second IP packet;

[0021] Send the second IP message.

[0022] This application provides an information processing method applied to a network boundary device, the method comprising:

[0023] Receive the second IP message;

[0024] in,

[0025] The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application.

[0026] Furthermore, according to at least one embodiment of this application, the method further includes:

[0027] Parse the second IP packet to obtain the first ARN identifier;

[0028] The validity of the first ARN identifier is verified according to a preset data table, and the verification result is obtained; the preset data table stores a preset correspondence between user information and ARN identifiers;

[0029] If the verification result indicates that the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0030] Furthermore, according to at least one embodiment of this application, the method further includes:

[0031] If the verification result indicates that the first ARN identifier is invalid, perform the first operation;

[0032] The first operation includes one of the following:

[0033] Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet;

[0034] Reset the value of the first ARN identifier;

[0035] Map the second IP packet to the default path or slice corresponding to the packet that does not carry the ARN identifier.

[0036] Furthermore, according to at least one embodiment of this application, the verification of the legality of the first ARN identifier based on a preset data table includes:

[0037] Parse the second IP packet to obtain the first user information;

[0038] Find the correspondence between the first user information and the first ARN identifier in the preset data table;

[0039] If the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid.

[0040] Furthermore, according to at least one embodiment of this application, mapping the second IP packet to the corresponding path or slice based on the first ARN identifier includes:

[0041] If the first ARN identifier is valid, determine the first path or first slice corresponding to the first ARN identifier according to the preset correspondence between the path or slice and the ARN identifier; map the second IP packet to the first path or the first slice;

[0042] The path or slice includes one of the following:

[0043] Policy-based IPv6 segmentation routing (SRv6 Policy, Segment Routing over IPv6 basePolicy).

[0044] Multiprotocol label switching (MPLS);

[0045] Internet Layer 3 Protocol (IP-to-IP);

[0046] Virtual Extended Local Area Network (VxLAN).

[0047] General Routing Encapsulation (GRE) protocol.

[0048] Generic Network Virtualization Encapsulation (GENEVE).

[0049] This application provides an information processing method applied to a controller, the method comprising:

[0050] Send a first ARN identifier to the user boundary device; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application;

[0051] The first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet.

[0052] Furthermore, according to at least one embodiment of this application, the method further includes:

[0053] The preset correspondence between user information and ARN identifiers is sent to the network boundary device; and the preset correspondence between paths or slices and ARN identifiers is sent to the network boundary device.

[0054] The path or slice includes one of the following:

[0055] SRv6;

[0056] MPLS;

[0057] IPinIP;

[0058] VxLAN;

[0059] GRE;

[0060] GENEVE.

[0061] Furthermore, according to at least one embodiment of this application, the method further includes:

[0062] The first ARN identifier is assigned to the user boundary device based on user information, application information, and network service information.

[0063] Furthermore, according to at least one embodiment of this application, the method further includes:

[0064] Manage the lifecycle of the first ARN identifier.

[0065] Furthermore, according to at least one embodiment of this application, the management of the lifecycle of the first ARN identifier includes:

[0066] Perform one of the following operations on the first ARN identifier:

[0067] Cancel;

[0068] Report the loss;

[0069] Replacement;

[0070] aging;

[0071] postpone.

[0072] This application provides an information processing apparatus, including:

[0073] The acquisition module is used to acquire a first ARN identifier; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application;

[0074] The processing module is used to mark the first IP packet based on the first ARN identifier and generate a second IP packet;

[0075] The first sending module is used to send the second IP packet.

[0076] This application provides an information processing apparatus, including:

[0077] The receiving module is used to receive the second IP packet;

[0078] in,

[0079] The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application.

[0080] This application provides an information processing apparatus, including:

[0081] The second sending module is used to send a first ARN identifier to the user boundary device; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application;

[0082] The first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet.

[0083] This application provides a user boundary device, including a processor and a memory for storing computer programs that can run on the processor.

[0084] When the processor runs the computer program, it executes the steps of any one of the methods described above for the user boundary device.

[0085] This application provides a network boundary device, including a processor and a memory for storing computer programs that can run on the processor.

[0086] When the processor runs the computer program, it executes the steps of any of the methods described above for the network boundary device side.

[0087] This application provides a controller, including a processor and a memory for storing computer programs that can run on the processor.

[0088] When the processor runs the computer program, it executes the steps of any of the methods described above on the controller side.

[0089] At least one embodiment of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in the user boundary device method, or implements the steps of any of the methods described in the network boundary device method, or implements the steps of any of the methods described in the controller method.

[0090] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method described in any one of the above-mentioned user boundary device methods, or implements the method described in any one of the above-mentioned network boundary device methods, or implements the method described in any one of the above-mentioned controller methods.

[0091] The information processing method, apparatus, device, storage medium, and computer program product provided in this application embodiment include: a user boundary device acquiring a first ARN identifier; the first ARN identifier representing the application's call relationship to network capabilities and / or the network's open capabilities to the application; marking a first IP packet based on the first ARN identifier to generate a second IP packet; and sending the second IP packet.

[0092] By adopting the technical solution provided in the embodiments of this application, since the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application, the user or application does not directly call network capabilities, but calls network capabilities through the first ARN identifier. In this way, the network will not see the relevant information of the user or application. Similarly, the network does not directly open capabilities to the user, but opens capabilities through the first ARN identifier. In this way, the user will not see the network's service information, thereby improving network security while providing application collaborative network capabilities. Attached Figure Description

[0093] Figure 1 This is a schematic diagram of the application of the Application-Aware Networking (APN) header in related technologies;

[0094] Figure 2 This is a schematic diagram of the implementation flow of the information processing method in the embodiments of this application. Figure 1 ;

[0095] Figure 3 This is a schematic diagram of the implementation flow of the information processing method in the embodiments of this application. Figure 2 ;

[0096] Figure 4 This is a schematic diagram of the implementation flow of the information processing method in the embodiments of this application. Figure 3 ;

[0097] Figure 5 This is a schematic diagram of the system architecture for the information processing method described in the embodiments of this application;

[0098] Figure 6 This is a schematic diagram illustrating the specific implementation flow of the information processing method in the embodiments of this application;

[0099] Figure 7 This is a schematic diagram of the controller assigning a first ARN ID to a user boundary device according to an embodiment of this application;

[0100] Figure 8 This is a schematic diagram of the lifecycle of the ARN ID in an embodiment of this application;

[0101] Figure 9 This is a schematic diagram of marking the first IP packet in an embodiment of this application. Figure 1 ;

[0102] Figure 10 This is a schematic diagram of marking the first IP packet in an embodiment of this application. Figure 2 ;

[0103] Figure 11 This is a schematic diagram of marking the first IP packet in an embodiment of this application. Figure 3 ;

[0104] Figure 12 This is a schematic diagram of marking the first IP packet in an embodiment of this application. Figure 4 ;

[0105] Figure 13 This is a schematic diagram of the information processing device according to an embodiment of this application. Figure 1 ;

[0106] Figure 14 This is a schematic diagram of the information processing device according to an embodiment of this application. Figure 2 ;

[0107] Figure 15 This is a schematic diagram of the information processing device according to an embodiment of this application. Figure 3 ;

[0108] Figure 16 This is a schematic diagram of the composition structure of the user boundary device according to an embodiment of this application;

[0109] Figure 17 This is a schematic diagram of the composition structure of the network boundary device according to an embodiment of this application;

[0110] Figure 18 This is a schematic diagram of the composition structure of the controller in an embodiment of this application. Detailed Implementation

[0111] Before introducing the technical solutions of the embodiments of this application, the relevant technologies will be introduced first.

[0112] In related technologies, the Internet provides a best-effort service, and the digital economy is fully built on the Internet Protocol (IP) network. Diverse application demands place higher requirements on network capabilities, driving the continuous evolution of IP technology to meet higher quality assurance requirements. Unlike the fixed resource allocation of Optical Transport Networks (OTN), IP is essentially statistical time-division multiplexing; IP network quality depends on path congestion and the bit error rate of the underlying optical links. To provide quality assurance capabilities in IP networks, technologies from Multiprotocol Label Switching (MPLS) in 2000 to the current Segment Routing over IPv6 (SRv6) focus on providing network path scheduling capabilities. By planning network link resources, point-to-point network paths with different characteristics can be constructed, such as low latency and high bandwidth. Furthermore, based on the above capabilities, combined with bandwidth resource reservation mechanisms, network-wide slicing capabilities can be achieved, allowing a physical network to be virtually divided into multiple logical fragments, each occupying different resources, thereby realizing differentiated multi-point to multi-point network connections.

[0113] Although IP backbone networks already possess flexible and differentiated service capabilities, there are various approaches to existing solutions when it comes to the coordination of application and network capabilities.

[0114] The first approach is to classify traffic based on application characteristics and then route different traffic to specific network paths (MPLS or SRv6). This typically involves two schemes based on application identification:

[0115] The first approach uses Access Control Lists (ACLs) based on Layer 3 and 4 header information for application type classification. At the network boundary service access point, traffic is classified by matching the source IP, destination IP, protocol type, source port, and destination port five-tuple using ACLs, and then diverted to specific low-latency or high-bandwidth tunnels / slices. Router and switch hardware chips typically support ACLs, enabling high-performance forwarding. However, ACLs require manual maintenance of the application's five-tuple characteristics and configuration on network devices via ACL commands. After flow classification by ACLs, the next ACL is specified for the flow, thereby directing the flow to the designated SRv6 / MPLS tunnel or slice.

[0116] The second approach employs Deep Packet Inspection (DPI) based on Layer 7 content information for application type classification. To extract Layer 7 content, DPI needs to identify packet encapsulation, reassemble a series of packets to restore application data, and then classify them based on the characteristics of this application data. DPI typically describes application characteristics using regular expressions, which cannot be processed by routing chips and must be handled by the CPU. Common application characteristics include URLs, HTML tags, and text. Similar to ACLs, application characteristics need to be manually maintained and configured on network devices, and additionally, the ability to reassemble multiple packets into application data is required. After DPI performs flow classification, it directs the flow to a specified SRv6 / MPLS tunnel or slice by assigning a next criterion to the flow.

[0117] The second approach involves explicitly carrying application type information. The network boundary service access point (PE) identifies the application information explicitly carried in the packet and then maps the packet to the network tunnel / slice.

[0118] Application-Aware Networking (APN) is an additional feature in IPv6 datagrams, defining application information. APN utilizes the programmable space of built-in IPv6 extension headers, such as the Hop-by-Hop Options Header (HBH) and Destination Options Header (DOH). Unlike ACLs and DPIs, APNs require packets to carry application information, enabling network devices to directly identify the application. Based on the APN information, flow classification is performed, and the next hop is assigned to the flow, thus directing the flow to a designated SRv6 / MPLS tunnel or slice. APNs need to explicitly carry the APN ID in the packet in an unencrypted manner. This requires applications to be willing to tag their APN IDs, and also necessitates a unified organization to centrally allocate APN IDs to applications. Depending on the location of the APN ID tagging, there are two methods: endpoint tagging and network tagging. Considering that applications may not yet have the capability, network boundary service access point tagging can be used initially. As the ecosystem matures, more services can autonomously carry their APN IDs, further improving the accuracy of service awareness.

[0119] See Figure 1 , Figure 1 This is a schematic diagram of the APN header in related technologies, such as... Figure 1 As shown, the APN header contains APN identification information and APN parameter information, and the APN header can be used in different data planes.

[0120] like Figure 1As shown, the APN header format may include:

[0121] APN ID;

[0122] APN parameter information (APN-Para).

[0123] Here, the APN ID is used to identify the service attribute, indicating that messages carrying the same identifier will be given the same processing. Specifically, it includes the following information: APP Group ID, which identifies the application group to which the message belongs, and has a variable length; and USERGroup ID, which identifies the user group to which the message belongs, and has a variable length.

[0124] Here, APN parameter information (APN-Para) refers to parameters related to network performance requirements. The specific parameters included are defined by APN-Para-Type, and each APN parameter is 32 bits long. Different combinations of parameter information can provide a more detailed description of application requirements. APN-Para is transmitted along with APN ID information to describe the required network connectivity, specifically including the following information: Bandwidth, indicating the application's bandwidth requirement in Mbit / s; Delay, the first 8 bits are reserved, must be set to 0 when sending, and must be ignored when receiving, the last 24 bits indicate the latency requirement in ms, encoded as an integer value; Jitter, the first 8 bits are reserved, must be set to 0 when sending, and must be ignored when receiving, the last 24 bits indicate the latency variation requirement in ms, encoded as an integer value; Packet Loss Ratio, the first 8 bits are reserved, must be set to 0 when sending, and must be ignored when receiving, the last 24 bits indicate the packet loss rate per second, which is the maximum packet loss rate allowed by the system.

[0125] Here, the APN header (including the APN identifier and required parameters) can be encapsulated in the IPv6 packet extension header, specifically in the following ways:

[0126] Hop-by-Hop Options Header (HBH): The APN header can be carried as a new option in the hop-by-hop options header. By using the information carried in the hop-by-hop options header, it can be read by each node on the path.

[0127] Destination Option Header (DOH): The APN header can be carried as a new option in the Destination Option Header. The information carried by the Destination Option Header can be read by the corresponding nodes on the path.

[0128] Segment Routing Header (SRH): The APN header can also be placed in the segment routing header as a type of segment routing header TLV, immediately following the segment list. The information carried by the segment routing header can be read by the specified segment on the SRv6 path.

[0129] In an APN network, the application information carried by data packets can indicate the application (class) to which the data packet belongs, the user (group) information using the application (class), the key flow in the application (e.g., action instructions in cloud gaming), SLA requirements, or network performance requirements parameters (e.g., bandwidth, latency, jitter, packet loss rate).

[0130] The third approach is to directly expose network connections, allowing applications to invoke them. Primarily used in SRv6 network scenarios, this abstracts network connection services through Binding SIDs (BSIDs). This method is mainly applied in SD-WAN, where the IP backbone abstracts the paths between PEs into BSIDs with different service capabilities, such as low latency, high bandwidth, and low packet loss. At the terminal, different BSIDs are directly added to the path list. This approach requires publicly exposing the BSIDs, which are shared by multiple services. Once exposed, this can easily lead to network attacks, BSID bandwidth misuse, and other security issues. Furthermore, since BSIDs are shared resources, disabling them can impact services, making it impossible to eliminate security risks simply by disabling them.

[0131] The two existing approaches have different problems that prevent them from being widely used on the live network.

[0132] For the first type of application, ACL and DPI are only used in specific scenarios.

[0133] The main problem with ACLs is that more and more applications are sharing a single User Datagram Protocol (UDP) port, making it impossible to directly identify and distinguish applications based on the UDP port. Overly complex ACLs can also negatively impact the device's forwarding performance for application packets and generate a large number of "zombie" entries. Especially when application changes cause configuration failures, the ACL configuration also needs to be updated accordingly, making maintenance extremely complex.

[0134] DPI (Data Point Injection) can solve the problem of ACLs failing to accurately identify applications, but its deployment also has significant limitations. First, DPI requires CPU processing, consuming substantial processing power. Second, DPI cannot handle encrypted messages, while the vast majority of internet traffic is encrypted, such as HTTPS. Therefore, large-scale application is difficult.

[0135] For approach two, the APN method suffers from the following unresolved core issues, leading to insufficient user willingness to use it and high network security risks, thus hindering its deployment for many years:

[0136] Question 1: APN ID privacy and security issues. If traffic can be identified through the APN, there is a risk of traffic being hijacked and analyzed, leading to less incentive for users to use APNs.

[0137] The second problem is the extreme difficulty in managing APN IDs. APN IDs require unified management across the entire network, with different applications needing to be distinguished by different values. However, the internet lacks a centralized application APN ID registration and management mechanism, and a large number of new applications are generated every day, making implementation difficult.

[0138] Question 3: APN ID leakage. Packets may be intercepted during forwarding, and non-accelerated users can obtain this APN ID, thus including it in packets sent by non-accelerated users and illegally gaining acceleration benefits.

[0139] Question 4: Network attack risk. APN packets have distinctive characteristics and are easy to attack. Hackers can launch DDoS attacks targeting packets using APN IDs, which poses a risk to the stable operation of the network.

[0140] For approach three, using BSID to open network connections carries similar security risks to APN, namely, attacks and misuse caused by the leakage of internal network information. Therefore, this method is limited to use within an intranet.

[0141] In general, both School 1 and School 2 adopt an application-centric approach, requiring the network to passively adapt to application changes. School 3 adopts an approach of open network capabilities, and all three approaches have network security issues.

[0142] Based on this, in this embodiment of the application, the user boundary device obtains a first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the first IP packet is marked based on the first ARN identifier to generate a second IP packet; and the second IP packet is sent.

[0143] See Figure 2 , Figure 2 This is a schematic diagram illustrating the implementation flow of the information processing method according to an embodiment of this application. It is applied to a user boundary device, which can be a client router, SD-WAN CPE, cloud gateway, or an application, such as... Figure 2 As shown, the method includes steps 201 to 203:

[0144] Step 201: Obtain the first ARN identifier; the first ARN identifier represents the application's calling relationship with network capabilities and / or the network's open capabilities to the application.

[0145] Here, network capabilities can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0146] Here, the service type of the path or slice includes, but is not limited to, one of the following:

[0147] Low latency;

[0148] High bandwidth;

[0149] Low packet loss.

[0150] Here, the application's invocation of network capabilities may include, but is not limited to, one of the following:

[0151] Applications invoke low-latency network capabilities;

[0152] Applications call upon high-bandwidth network capabilities;

[0153] Application calls upon low packet loss network capabilities.

[0154] Here, the application's call to low-latency network capabilities can also be described as the application's call to low-latency path or slice services.

[0155] Here, the application's call to high-bandwidth network capabilities can also be described as the application's call to high-bandwidth path or slice services.

[0156] Here, the application's call to low packet loss network capabilities can also be described as the application's call to low packet loss path or slice services.

[0157] Here, the network's ability to open up to applications can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0158] Step 202: Mark the first IP packet based on the first ARN identifier to generate the second IP packet.

[0159] As an example, the first IP packet could refer to an IPv6 packet.

[0160] In some embodiments, marking the first IP packet based on the first ARN identifier includes:

[0161] Write the first ARN identifier and the first information into the flow label field and traffic type field in the header of the first IP packet, respectively;

[0162] The first information is used to indicate whether the original content in the stream tag field is escaped into the first ARN identifier.

[0163] As an example, the first information can also be described as an escape character.

[0164] As an example, the first information may be located in the highest position of the traffic class field.

[0165] In other words, the Flow Label field is reused, and the highest bit (escape character) of the Traffic Class field (tc) indicates whether to escape. If the bit is 1, the original content in the Flow Label field is escaped to the first ARN ID; otherwise, no escaping is performed.

[0166] In some embodiments, marking the first IP packet based on the first ARN identifier includes:

[0167] Write the first ARN identifier into the extended header of the first IP packet;

[0168] or,

[0169] Write the first ARN identifier into the source address field of the header of the first IP packet.

[0170] As an example, the extended head can refer to DOH, HBH, or SRH heads.

[0171] Here, an ARN ID field is introduced into the first IP packet to connect the application and the network. The first ARN ID not only expresses the calling relationship between the application and the network, but also expresses the application's requirements for network paths or slices, such as path constraints such as latency, packet loss, jitter, and bandwidth.

[0172] In some embodiments, obtaining the first ARN identifier includes:

[0173] Obtain the first ARN identifier sent by the controller;

[0174] The first ARN identifier is assigned to the user boundary device by the controller based on user information, application information, and network service information.

[0175] For example, assuming low-latency slice or path (tunnel) services are planned in the network, how does the network complete the business process and forward the data when a user subscribes to a low-latency connection service? First, the business system calls the controller interface according to the type of service the user subscribes to. After receiving the user's network service subscription request, the controller assigns the first ARN identifier to the user's boundary.

[0176] Specifically, the controller can assign the first ARN identifier to the user boundary device based on user information, application information, and network service information.

[0177] Here, the first ARN ID can be any integer, as long as there is a one-to-one correspondence between the <user, application, network service> and the ARN ID. Specifically, it can be generated using a random function, or generated in ascending order, or in descending order.

[0178] Here, after the controller assigns the first ARN ID to the user boundary device, it can also manage the lifecycle of the first ARN identifier, specifically including:

[0179] Perform one of the following operations on the first ARN identifier:

[0180] Cancel;

[0181] Report the loss;

[0182] Replacement;

[0183] aging;

[0184] postpone.

[0185] Here, revocation refers to the controller deleting the relevant ARN ID information at the user and network edge.

[0186] Here, reporting a lost ID also corresponds to canceling the associated ARN ID.

[0187] Here, "reissue" refers to the need to regenerate an ARN ID.

[0188] Here, aging refers to the fact that the corresponding APN service has a time limit, and the corresponding APN ID is automatically revoked after the time expires.

[0189] Here, the extension refers to extending the service period of ARN ID.

[0190] Step 203: Send the second IP packet.

[0191] As an example, the second IP packet can be sent to a network boundary device.

[0192] As an example, the network boundary device is a BRAS / BNG for home users, a router that connects to the core network for wireless users, and a PE that connects to the user's leased line for government and enterprise users.

[0193] As an example, after receiving the second IP packet, the network boundary device parses the second IP packet to obtain the first ARN identifier carried in the first IP packet; and verifies the legality of the first ARN identifier.

[0194] Specifically, the validity of the first ARN identifier is verified, including the following two cases:

[0195] In the first scenario, if the first ARN identifier is verified to be valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0196] In the second scenario, if the first ARN identifier is found to be invalid, the first operation is performed.

[0197] The first operation includes one of the following:

[0198] Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet;

[0199] Reset the value of the first ARN identifier;

[0200] Map the second IP packet to the default path or slice corresponding to the packet that does not carry the ARN identifier.

[0201] In practical applications, in order for the network boundary device to verify the legitimacy of the first ARN identifier, the user boundary device can carry the first user information in the second IP packet, so that the network boundary device can verify the first ARN identifier.

[0202] Based on this, in some embodiments, sending the second IP packet includes:

[0203] The first user information is carried in the second IP packet;

[0204] Send the second IP message.

[0205] The embodiments of this application have the following advantages:

[0206] (1) The user boundary device obtains the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the first IP packet is marked based on the first ARN identifier to generate a second IP packet; the second IP packet is sent.

[0207] In this embodiment, since the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application, the user or application does not directly call network capabilities, but calls network capabilities through the first ARN identifier. In this way, the network will not see the user's or application's relevant information. Similarly, the network does not directly open capabilities to the user, but opens capabilities through the first ARN identifier. In this way, the user will not see the network's service information, thereby improving security while providing application-coordinated network capabilities.

[0208] (2) Compared with the methods of implementing application collaborative network capabilities through APN, BSID, ACL, etc. in related technologies, the embodiment of this application uses ARN identifier. The difference is that users / applications cannot directly call network paths, but must call network services through the intermediate ARN. The network cannot see user application information, but only the intermediate ARN. In contrast, APN directly carries application and user information, and the network can directly see this information. BSID directly exposes network capabilities to users, and users can directly see network service information.

[0209] In terms of privacy, the ARN ID does not directly use network connection identifiers such as BSID or SID. Instead, it uses an ARN ID that is independent of BSID. The ARN ID in the message takes a random value range for different users. The controller can map a user's network request contract to different ARN ID values ​​for different devices and set it to be device-valid rather than globally valid. Different devices can have different ARN ID values. Therefore, it does not carry network privacy information or user privacy information.

[0210] In terms of maintainability, network capabilities are expressed through ARN IDs, which are unaffected by application changes. Therefore, there is no issue of frequent configuration changes caused by rapid application iterations, making it easier to expose network capabilities through planning. Furthermore, since there is a one-to-one correspondence between the ARN ID and the actual user's payment contract, information configuration can be easily embedded into business processes, eliminating the need to convert contracts into ACL 5-tuples or APN IDs.

[0211] In terms of scalability, if only 2-tuples of (ARN ID, user) are configured for differentiated user needs, and these 2-tuples can be implemented by looking up a table, then this solution does not have scalability issues.

[0212] In terms of security, the ARN ID sits between the application and the network, possessing a lifecycle similar to a contract, with capabilities for creation, destruction, expiration, updating, and verification. If ARN ID information is found to be leaked, it can be quickly reported lost without affecting other users' services, and a new ARN ID can be requested. Furthermore, packets entering the SR network can be correctly mapped to the corresponding SR Policy path based on the ARN ID even without carrying the BSID / SID. Even when carrying the BSID / SID, the legitimacy of BSID / SID calls to the network can be verified using the ARN ID. This resolves the security issue.

[0213] Finally, the scope of network ARN IDs can be divided into two categories: one is the global ARN ID, which has the same lifecycle, but the same ARN ID can be different on different devices at different sites; the other is the localized ARN ID, which is designed for the local needs of individual users, and the lifecycles of different ARN IDs are independent of each other. Customers need to carry local ARN IDs in their packets. Because ARN ID values ​​do not need to be the same globally, the need for coordination is minimized.

[0214] (3) Adopting a network-centric approach, this paper proposes Application Responsive Networking (ARN) technology to address a series of security issues, eliminate the impact of rapidly changing applications on network stability, and enable large-scale deployment through applications actively invoking network capabilities. It can solve the problem of network stability being difficult to converge due to frequent changes in network ACL, DPI, and APN configurations caused by application changes in related technologies; the problem of high resource consumption and maintenance difficulties caused by the highly discrete nature of application characteristics, making aggregation difficult and requiring ACL and APN configurations to be done one by one for each service; the problem of APN and BSID needing to carry privacy information in related technologies; and the security problems caused by the leakage of APN and BSID information, such as APN ID and BSID being impersonated or attacked.

[0215] See Figure 3 , Figure 3 This is a schematic diagram illustrating the implementation flow of the information processing method in this application embodiment, applied to a network boundary device. For home users, this network boundary device is a BRAS / BNG; for wireless users, it is a router connecting to the core network; and for enterprise users, it is a PE (Preinstallation Equipment) accessing the user's leased line. Figure 3 As shown, the method includes step 301:

[0216] Step 301: Receive the second IP packet;

[0217] The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application.

[0218] Here, network capabilities can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0219] Here, the service type of the path or slice includes, but is not limited to, one of the following:

[0220] Low latency;

[0221] High bandwidth;

[0222] Low packet loss.

[0223] Here, the application's invocation of network capabilities may include, but is not limited to, one of the following:

[0224] Applications invoke low-latency network capabilities;

[0225] Applications call upon high-bandwidth network capabilities;

[0226] Application calls upon low packet loss network capabilities.

[0227] Here, the application's call to low-latency network capabilities can also be described as the application's call to low-latency path or slice services.

[0228] Here, the application's call to high-bandwidth network capabilities can also be described as the application's call to high-bandwidth path or slice services.

[0229] Here, the application's call to low packet loss network capabilities can also be described as the application's call to low packet loss path or slice services.

[0230] Here, the network's ability to open up to applications can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0231] In some embodiments, the method further includes:

[0232] Parse the second IP packet to obtain the first ARN identifier;

[0233] The validity of the first ARN identifier is verified according to a preset data table, and the verification result is obtained; the preset data table stores a preset correspondence between user information and ARN identifiers;

[0234] If the verification result indicates that the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0235] As an example, the user information may include the user's corresponding user identifier, source address information, or link information, etc.

[0236] As an example, the network boundary device can receive a preset correspondence between user information and ARN identifiers sent by the controller.

[0237] In some embodiments, the method further includes:

[0238] If the verification result indicates that the first ARN identifier is invalid, perform the first operation;

[0239] The first operation includes one of the following:

[0240] Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet;

[0241] Reset the value of the first ARN identifier;

[0242] Map the second IP packet to the default path or slice corresponding to the packet that does not carry the ARN identifier.

[0243] As an example, resetting the value of the first ARN identifier can be achieved by resetting the first ARN ID to 0 according to the configuration.

[0244] Here, if the first ARN ID is ignored, the packet is forwarded via the default tunnel / slice. Packets that do not carry an ARN ID should also be forwarded via the default tunnel / slice. This way, during network upgrades, user-side devices and network boundary devices do not need to simultaneously support this feature.

[0245] In some embodiments, verifying the legality of the first ARN identifier according to a preset data table includes:

[0246] Parse the second IP packet to obtain the first user information;

[0247] Find the correspondence between the first user information and the first ARN identifier in the preset data table;

[0248] If the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid.

[0249] As an example, if the correspondence between the first user information and the first ARN identifier is not found in the preset data table, then the first ARN identifier is determined to be invalid.

[0250] As an example, the first user information can be obtained through the source address field of the second IP packet.

[0251] For example, the preset correspondence between user information and ARN identifiers may include: user information is Ua, the corresponding ARN identifier is value 1; user information is Ub, the corresponding ARN identifier is value 2; user information is Uc, the corresponding ARN identifier is value 3. Thus, assuming the first user information is Ub and the first ARN identifier is value 2, it indicates that the correspondence between the first user information and the first ARN identifier is found in the preset data table, and the first ARN identifier is determined to be valid.

[0252] In some embodiments, mapping the second IP packet to the corresponding path or slice based on the first ARN identifier includes:

[0253] If the first ARN identifier is valid, determine the first first path or first slice corresponding to the first ARN identifier according to the preset correspondence between the path or slice and the ARN identifier; map the second IP packet to the first path or first slice;

[0254] The path or slice includes one of the following:

[0255] Policy-based IPv6 fragmentation routing (SRv6);

[0256] Multiprotocol Label Switching (MPLS);

[0257] Internet Layer 3 Protocol (IP-to-IP);

[0258] Virtual Extended Local Area Network (VxLAN);

[0259] Generic Routing Encapsulation Protocol (GRE);

[0260] Geneve, a general network virtualization encapsulation.

[0261] As an example, the network boundary device can obtain preset correspondences between tunnels and ARN identifiers such as SRv6, Multiprotocol Label Switching (MPLS), Internet Layer 3 Protocol IPinIP, Virtual Extended LAN (VxLAN), Generic Routing Encapsulation Protocol (GRE), and Geneve Network Virtualization Encapsulation (GENEVE) from the controller.

[0262] For example, taking SRv6 as an example, suppose there are SRv6 tunnels 1, 2, and 3. SRv6 tunnel 1 is designated by tunnel color a (high bandwidth path or slice), and its corresponding ARN identifier is value 1. SRv6 tunnel 2 is designated by tunnel color b (low latency path or slice), and its corresponding ARN identifier is value 2. SRv6 tunnel 3 is designated by tunnel color c (low packet loss path or slice), and its corresponding ARN identifier is value 3. Thus, assuming the first ARN identifier is value 2, the corresponding first path or slice can be determined to be SRv6 tunnel 2. In this way, the second IP packet is mapped to the low latency path or slice corresponding to tunnel color b.

[0263] The embodiments of this application have the following advantages:

[0264] (1) The user boundary device obtains the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the first IP packet is marked based on the first ARN identifier to generate a second IP packet; the second IP packet is sent.

[0265] In this embodiment, since the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application, the user or application does not directly call network capabilities, but calls network capabilities through the first ARN identifier. In this way, the network will not see the user's or application's relevant information. Similarly, the network does not directly open capabilities to the user, but opens capabilities through the first ARN identifier. In this way, the user will not see the network's service information, thereby improving network security while providing application-coordinated network capabilities.

[0266] See Figure 4 , Figure 4 This is a schematic diagram illustrating the implementation flow of the information processing method according to an embodiment of this application, applied to a controller, such as... Figure 4 As shown, the method includes step 401:

[0267] Step 401: Send the first ARN identifier to the user boundary device; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application;

[0268] The first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet.

[0269] In some embodiments, the method further includes:

[0270] The preset correspondence between user information and ARN identifiers is sent to the network boundary device; and the preset correspondence between paths or slices and ARN identifiers is sent to the network boundary device.

[0271] The path or slice includes one of the following:

[0272] SRv6;

[0273] MPLS;

[0274] IPinIP;

[0275] VxLAN;

[0276] GRE;

[0277] GENEVE.

[0278] As an example, the controller sends a preset correspondence between user information and ARN identifier to the network boundary device. In this way, the network boundary device can verify the legitimacy of the first ARN identifier based on the preset correspondence between user information and ARN identifier.

[0279] As an example, the controller sends a preset mapping relationship between the path or slice and the ARN identifier to the network boundary device. In this way, the network boundary device can map the second IP packet to the path or slice corresponding to the first ARN identifier, based on the preset mapping relationship between the path or slice and the ARN identifier, provided that the first ARN identifier is valid.

[0280] In some embodiments, the method further includes:

[0281] The first ARN identifier is assigned to the user boundary device based on user information, application information, and network service information.

[0282] Here, the first ARN ID can be any integer, as long as there is a one-to-one correspondence between <user, application, network service> and the ARN ID. Specifically, the first ARN identifier can be generated using a random function, or generated in ascending order, or in descending order.

[0283] In some embodiments, the method further includes:

[0284] Manage the lifecycle of the first ARN identifier.

[0285] In some embodiments, managing the lifecycle of the first ARN identifier includes:

[0286] Perform one of the following operations on the first ARN identifier:

[0287] Cancel;

[0288] Report the loss;

[0289] Replacement;

[0290] aging;

[0291] postpone.

[0292] Here, revocation refers to the controller deleting the relevant ARN ID information at the user and network edge.

[0293] Here, reporting a lost ID also corresponds to canceling the associated ARN ID.

[0294] Here, "reissue" refers to the need to regenerate an ARN ID.

[0295] Here, aging refers to the fact that the corresponding APN service has a time limit, and the corresponding APN ID is automatically revoked after the time expires.

[0296] Here, the extension refers to extending the service period of ARN ID.

[0297] The embodiments of this application have the following advantages:

[0298] (1) The user boundary device obtains the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the first IP packet is marked based on the first ARN identifier to generate a second IP packet; the second IP packet is sent.

[0299] In this embodiment, since the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application, the user or application does not directly call network capabilities, but calls network capabilities through the first ARN identifier. In this way, the network will not see the user's or application's relevant information. Similarly, the network does not directly open capabilities to the user, but opens capabilities through the first ARN identifier. In this way, the user will not see the network's service information, thereby improving security while providing application-coordinated network capabilities.

[0300] See Figure 5 , Figure 5 This is a schematic diagram of the system architecture for the information processing method applied in the embodiments of this application, such as... Figure 5 As shown, the system includes:

[0301] The controller is used to assign a first ARN identifier to the user boundary device; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application.

[0302] The user boundary device (CPE1) is used to mark the first IP packet based on the first ARN identifier, generate a second IP packet, and send the second IP packet to the network boundary device.

[0303] A network edge device (PE) is used to parse the second IP packet to obtain the first ARN identifier and the first user information (such as user ID); using the first user information, the legality of the first ARN identifier is verified; if the first ARN identifier is legal, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0304] Here, the user boundary device can be a client router, an SD-WAN CPE, a cloud gateway, or an application.

[0305] Here, the network boundary device is a BRAS / BNG for home users, a router that connects to the core network for wireless users, and a PE that connects to the user's leased line for government and enterprise users.

[0306] See Figure 6 , Figure 6 This is a schematic diagram illustrating the specific implementation flow of the information processing method in the embodiments of this application, such as... Figure 6 As shown, the method includes steps 601 to 607:

[0307] Step 601: The controller assigns a first ARN identifier to the user boundary device; the first ARN identifier represents the application's calling relationship with network capabilities and / or the network's open capabilities to the application.

[0308] Here, network capabilities can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0309] Here, the service type of the path or slice includes, but is not limited to, one of the following:

[0310] Low latency;

[0311] High bandwidth;

[0312] Low packet loss.

[0313] Here, the application's invocation of network capabilities may include, but is not limited to, one of the following:

[0314] Applications invoke low-latency network capabilities;

[0315] Applications call upon high-bandwidth network capabilities;

[0316] Application calls upon low packet loss network capabilities.

[0317] Here, the application's call to low-latency network capabilities can also be described as the application's call to low-latency path or slice services.

[0318] Here, the application's call to high-bandwidth network capabilities can also be described as the application's call to high-bandwidth path or slice services.

[0319] Here, the application's call to low packet loss network capabilities can also be described as the application's call to low packet loss path or slice services.

[0320] Here, the network's ability to open up to applications can refer to network resources, specifically including paths or slices, where a path can be understood as a tunnel.

[0321] For example, assuming low-latency slice or path (tunnel) services are planned in the network, how does the network complete the business process and forward the data when a user subscribes to a low-latency connection service? First, the business system calls the controller interface according to the type of service the user subscribes to. After receiving the user's network service subscription request, the controller assigns the first ARN identifier to the user's boundary.

[0322] Specifically, the controller can assign the first ARN identifier to the user boundary device based on user information, application information, and network service information.

[0323] Here, the first ARN ID can be any integer, as long as there is a one-to-one correspondence between <user, application, network service> and the ARN ID. Specifically, the first ARN identifier can be generated using a random function, or generated in ascending order, or in descending order.

[0324] Figure 7 This is a schematic diagram of the controller assigning a first ARN ID to a user boundary device according to an embodiment of this application, as shown below. Figure 7 As shown, assuming the user information is Ua, the application information is a video application, and the network service information is a low-latency path or slice, an ARN ID is randomly selected from the unassigned ARN ID database and assigned as the first ARN ID to the corresponding user boundary device. Similarly, assuming the user information is Ua, the application information is a video application, and the network service information is a low-latency and high-bandwidth path or slice, two ARN IDs are randomly selected from the unassigned ARN ID database and assigned as the first ARN ID to the corresponding user boundary device.

[0325] Here, the user boundary device is used to invoke network capabilities.

[0326] The user boundary device can be a client router, an SD-WAN CPE, a cloud gateway, or an application.

[0327] Figure 8 This is a schematic diagram of the lifecycle of the ARN ID in an embodiment of this application, as shown below. Figure 8 As shown, ARN IDs have three states: unassigned, active, and silent. Initially, ARN IDs are in the unassigned state. Once assigned, they enter the active state. During the active state, if the ARN ID service contract expires, the user terminates the contract early, or the ID is reported lost, the ARN ID will enter the silent state. ARN IDs in the silent state are in a suspended state. This is to avoid conflicts or security risks, so they are not assigned to external parties for a period of time. After a period of time (usually six months or more), they are recycled back to the unassigned ARN ID database.

[0328] Here, after the controller assigns the first ARN ID to the user boundary device, it can also manage the lifecycle of the first ARN identifier, specifically including:

[0329] Perform one of the following operations on the first ARN identifier:

[0330] Cancel;

[0331] Report the loss;

[0332] Replacement;

[0333] aging;

[0334] postpone.

[0335] Here, revocation refers to the controller deleting the relevant ARN ID information at the user and network edge.

[0336] Here, reporting a lost ID also corresponds to canceling the associated ARN ID.

[0337] Here, "reissue" refers to the need to regenerate an ARN ID.

[0338] Here, aging refers to the fact that the corresponding APN service has a time limit, and the corresponding APN ID is automatically revoked after the time expires.

[0339] Here, the extension refers to extending the service period of ARN ID.

[0340] Step 602: The user boundary device marks the first IP packet based on the first ARN identifier and generates a second IP packet.

[0341] Here, the first IP packet can refer to an IPv6 packet.

[0342] Here, the length of the first ARN ID is at least 10 bits.

[0343] The following methods describe several frame formats carried in a message, with the first ARN ID being 20 bits. In IPv6 messages, ARN identifier (ID) information can be placed in the following ways:

[0344] The first method of carrying IPv6 headers is through escaping.

[0345] See Figure 9 , Figure 9 This is a schematic diagram illustrating the marking of the first IP packet in an embodiment of this application, as shown below. Figure 9 As shown, assuming the first IP packet is an IPv6 packet with a 20-bit ARN ID, the ARN ID and the first information (escape character) are written into the Flow Label field and the Traffic Class field in the header of the IPv6 packet, respectively; wherein, the first information is used to indicate whether to escape the original content in the Flow Label field into the ARN ID.

[0346] In other words, the 20 bits of the Flow Label are reused, and the highest bit (escape character) of the Traffic Class field (tc, trafficclass) indicates whether to escape. If the bit is 1, the original content in the Flow Label field is escaped to the ARN ID; otherwise, no escaping is performed.

[0347] The second method is to carry it through the IPv6 extension header.

[0348] See Figure 10 , Figure 10 This is a schematic diagram illustrating the marking of the first IP packet in an embodiment of this application, as shown below. Figure 10 As shown, assuming the first IP packet is an IPv6 packet with an ARN ID of 20 bits, the ARN ID is written into the extended header of the IPv6 packet, namely DOH and HBH. The type indicates that the 4 bytes (0 to 31 bits) are the ARN ID, and the flag is reserved and undefined.

[0349] The third method is to carry it through the IPv6 extension header.

[0350] See Figure 11 , Figure 11 This is a schematic diagram illustrating the marking of the first IP packet in an embodiment of this application, as shown below. Figure 11 As shown, assuming the first IP packet is an IPv6 packet with an ARN ID of 20 bits, the ARN ID is written into the SRH header of the IPv6 packet. The type indicates that the 4 bytes (0 to 31 bits) are the ARN ID, and the flag is reserved and undefined.

[0351] The fourth method is to carry it through the IPv6 source address.

[0352] See Figure 12 , Figure 12 This is a schematic diagram illustrating the marking of the first IP packet in an embodiment of this application, as shown below. Figure 12 As shown, assuming the first IP packet is an IPv6 packet and the ARN ID is 20 bits, the ARN ID is written into the source address field of the IPv6 packet.

[0353] In summary, the first ARN ID is actively carried in the first IP packet. The specific location can be DOH, HBH, SRH, FlowLabel, or source address. Specifically, if the Flow Label is reused to carry the ARN ID, the 7th bit of the Flow Type field (TC) needs to be set to 1 to indicate that the current Flow Label carries the ARN ID. When using DOH, HBH, or SRH to carry the ARN ID, an additional type field needs to be defined to indicate that this 32-bit field carries the ARN ID. When carrying the ARN ID through the source address, configuration is required to specify that packets received through a certain link or IP address will carry the ARN ID through the source address.

[0354] Step 603: The user boundary device sends the second IP packet to the network boundary device.

[0355] Here, the network boundary device is a BRAS / BNG for home users, a router that connects to the core network for wireless users, and a PE that connects to the user's leased line for government and enterprise users.

[0356] Step 604: The network boundary device parses the second IP packet to obtain the first ARN identifier; and verifies the validity of the first ARN identifier.

[0357] Specifically, the validity of the first ARN identifier is verified according to a preset data table; the preset data table stores a preset correspondence between user information and ARN identifiers. The user information may include the user's corresponding user identifier, source address information, or link information.

[0358] In other words, the interface of the network boundary device stores the ARN ID verification table, i.e., the preset data table. Each item in the data table contains the correspondence between user information and ARN identifier. The user information can be represented by the source IP address, etc.

[0359] Here, the network boundary device can obtain the preset data table from the controller.

[0360] Here, when the network boundary device receives a second IP packet containing a first ARN ID, it can obtain the first user information based on the source IP address in the second IP packet, and obtain the first ARN ID based on the second IP packet. Then, it can check whether the preset data table contains the correspondence between the first user information and the first ARN identifier to perform a validity check on the first ARN identifier.

[0361] Table 1 illustrates the correspondence between user information and ARN identifiers. As shown in Table 1, user information is Ua, and the corresponding ARN identifier is value 1; user information is Ub, and the corresponding ARN identifier is value 2; user information is Uc, and the corresponding ARN identifier is value 3.

[0362] Table 1

[0363]

[0364] Here, the verification of the legality of the first ARN identifier based on a preset data table includes:

[0365] Parse the second IP packet to obtain the first user information;

[0366] Find the correspondence between the first user information and the first ARN identifier in the preset data table;

[0367] If the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid.

[0368] If no correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be invalid.

[0369] Here, the first user information can be obtained through the ingress interface link or the source IP address in the second IP packet.

[0370] Step 605: If the ARN identifier is verified to be valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0371] Specifically, mapping the second IP packet to the corresponding path or slice based on the first ARN identifier includes:

[0372] Based on the preset correspondence between the path or slice and the ARN identifier, determine the first path or first slice corresponding to the first ARN identifier; map the second IP packet to the first path or the first slice;

[0373] The path or slice includes one of the following:

[0374] Policy-based IPv6 fragmentation routing (SRv6).

[0375] Multiprotocol Label Switching (MPLS);

[0376] Internet Layer 3 Protocol (IP-to-IP);

[0377] Virtual Extended Local Area Network (VxLAN);

[0378] Generic Routing Encapsulation Protocol (GRE);

[0379] Geneve, a general network virtualization encapsulation.

[0380] Here, network boundary devices can obtain a preset mapping between paths or slices and ARN identifiers from the controller.

[0381] Table 2 illustrates the correspondence between SRv6 tunnels and ARN identifiers. As shown in Table 2, taking SRv6 as an example, it includes SRv6 tunnel 1, SRv6 tunnel 2, and SRv6 tunnel 3. SRv6 tunnel 1 is tunnel color identifier a (high bandwidth path or slice), and the corresponding ARN identifier is value 1. SRv6 tunnel 2 is tunnel color identifier b (low latency path or slice), and the corresponding ARN identifier is value 2. SRv6 tunnel 3 is tunnel color identifier c (low packet loss path or slice), and the corresponding ARN identifier is value 3.

[0382] Table 2

[0383]

[0384] Here, assuming the first ARN identifier is the value 2, then according to Table 2, the corresponding first path or first slice can be determined as SRv6 tunnel 2, i.e., tunnel color identifier b (low latency path or slice). Thus, the second IP packet is mapped to SRv6 tunnel 2.

[0385] Step 606: If the ARN identifier is found to be invalid, perform the first operation.

[0386] Here, the first operation includes one of the following:

[0387] Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet;

[0388] Reset the value of the first ARN identifier;

[0389] Map the second IP packet to another path or slice.

[0390] In other words, if the first ARN ID carried by the second IP packet is not an invalid value of 0 and the validity check fails, the second IP packet can be processed as follows according to the configuration:

[0391] Ignore the first ARN ID in the second IP packet or discard the second IP packet according to the configuration; or...

[0392] The first ARN ID is reset to 0 according to the configuration; or...

[0393] If the first ARN ID is ignored, the second IP packet is forwarded as a slice and tunnel that does not contain the ARN ID.

[0394] In other words, if the first ARN ID is ignored, the packet will be forwarded via the default tunnel / slice. Packets that do not carry an ARN ID should also be forwarded via the default tunnel / slice. This way, during network upgrades, user-side devices and network boundary devices do not need to simultaneously support this feature.

[0395] In terms of collaborative application requirements and network capabilities, network ARN IDs are mainly used at network boundary service access points (such as PE, BRAS / BNG).

[0396] For example, assuming low-latency slice or tunnel services are planned in the network, when a user subscribes to a low-latency connection service, firstly, the business system calls the controller interface according to the type of service the user subscribes to. After receiving the user's network service subscription request, the controller will find the corresponding network boundary device (PE / BRAS / BNG) based on the locations of the two ends of the connection. Then, between this pair of PE / BRAS / BNG, a new or reused low-latency color tunnel identifier (color) using SRv6, Multiprotocol Label Switching (MPLS), Internet Layer 3 Protocol (IP-IP), Virtual Extended LAN (VxLAN), Generic Routing Encapsulation Protocol (GRE), Generic Network Virtualization Encapsulation (GENEVE), etc., will be created or reused according to the user's low-latency requirements to obtain the corresponding tunnel / slice. At the same time, the controller will generate an ARN ID for the user, application, and network service (corresponding to color), and look up the user's corresponding source address information or link information to identify the user. Then, the user (source address or link information) and ARN ID will be sent to the network boundary service access point PE / BRAS / BNG and associated with the network resource slice / tunnel. This completes the configuration of the network-side PE / BRAS / BNG.

[0397] On the user-side network, the controller locates the corresponding user boundary device (CPE / gateway device) based on the user and then issues the ARN ID information. This allows users to subsequently tag their applications with the ARN ID based on the application type. When sending packets to the network boundary device (PE / BRAS / BNG), the device can perform validity checks and enable the invocation of corresponding network capabilities. Users can also tag their applications with ARN IDs through ACLs, specifying links, etc., adding the ARN ID to user-side packets.

[0398] As can be seen, when providing differentiated network services to users, network services can use ARN IDs instead of BSIDs / SIDs to provide differentiated connections (low latency, high bandwidth tunnels / slices). On the user-side boundary device, multiple ARN IDs can be mapped to a single SR Policy. ARN IDs provide the ability to assign different values ​​to each user, unlike the security issues caused by multiple users sharing a single BSID. Unlike APN6, the value of an ARN ID is a numerical value that does not explicitly carry application or user information; it can be a random number or sequentially assigned value, thus avoiding the user privacy issues associated with APN6. On the network-side boundary device, unlike APN6 and BSIDs, multiple ARN IDs that can be mapped to the same network capabilities can be aggregated into a single ARN ID.

[0399] Here, the first ARN ID can be used for traffic billing along with user information. In BRAS / BNG scenarios, user information can be identified based on the link, i.e., the PPPoE connection, while in PE scenarios, it can be identified based on the source IP address or the leased link.

[0400] Here, the scope of the first ARN ID can be global or locally valid. Locally valid means that different ARN IDs on the device should remain unique; global means that one or more ARN IDs of a specific user within a certain range of devices can be mapped to a tunnel / slice in the network.

[0401] This example has the following advantages:

[0402] (1) Since the ARN ID does not explicitly carry the user's application information and each user's ARN ID is different, this solves the user privacy problem and also solves the network security problem caused by different users sharing the BSID.

[0403] (2) The user actively adds an ARN ID to the message. The ARN ID is actually equivalent to the routing policy Color (directly corresponding to the SR Policy Color). After the user message carries the ARN ID information into the network boundary service access point device (hereinafter referred to as PE), the PE can obtain the user information based on the source IP, and after verifying the validity of the ARN ID, it maps the ARN ID to a specific network tunnel / slice.

[0404] To implement the information processing method of this application embodiment, this application embodiment also provides an information processing device, which is installed in the user boundary device. Figure 13 This is a schematic diagram of the composition structure of the information processing device according to an embodiment of this application, as shown below. Figure 13 As shown, the device includes:

[0405] The acquisition module 131 is used to acquire a first ARN identifier; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application;

[0406] Processing module 132 is used to mark the first IP packet based on the first ARN identifier and generate a second IP packet;

[0407] The first sending module 133 is used to send the second IP packet.

[0408] In some embodiments, the processing module 132 is configured to:

[0409] Write the first ARN identifier and the first information into the flow label field and traffic type field in the header of the first IP packet, respectively;

[0410] The first information is used to indicate whether the original content in the stream tag field is escaped into the first ARN identifier.

[0411] In some embodiments, the processing module 132 is configured to:

[0412] Write the first ARN identifier into the extended header of the first IP packet;

[0413] or,

[0414] Write the first ARN identifier into the source address field of the header of the first IP packet.

[0415] In some embodiments, the acquisition module 131 is configured to:

[0416] Obtain the first ARN identifier sent by the controller;

[0417] The first ARN identifier is assigned to the user boundary device by the controller based on user information, application information, and network service information.

[0418] In some embodiments, the first transmitting module 133 is configured to:

[0419] The first user information is carried in the second IP packet;

[0420] Send the second IP message.

[0421] In practical applications, the acquisition module 131 and the first sending module 133 can be implemented by the communication interface in the information processing device; the processing module 132 can be implemented by the processor in the information processing device.

[0422] It should be noted that the information processing device provided in the above embodiments is only illustrated by the division of the above program modules. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the information processing device and the information processing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0423] To implement the information processing method of this application embodiment, this application embodiment also provides an information processing device, which is installed in a network boundary device. Figure 14 This is a schematic diagram of the composition structure of the information processing device according to an embodiment of this application, as shown below. Figure 14 As shown, the device includes:

[0424] Receiver module 141 is used to receive the second IP packet;

[0425] in,

[0426] The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application.

[0427] In some embodiments, the device is further configured to:

[0428] Parse the second IP packet to obtain the first ARN identifier;

[0429] The validity of the first ARN identifier is verified according to a preset data table, and the verification result is obtained; the preset data table stores a preset correspondence between user information and ARN identifiers;

[0430] If the verification result indicates that the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier.

[0431] In some embodiments, the device is further configured to:

[0432] If the verification result indicates that the ARN identifier is invalid, perform the first operation;

[0433] The first operation includes one of the following:

[0434] Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet;

[0435] Reset the value of the first ARN identifier;

[0436] Map the second IP packet to the default path or slice corresponding to the packet that does not carry the ARN identifier.

[0437] In some embodiments, the device is further configured to:

[0438] Parse the second IP packet to obtain the first user information;

[0439] Find the correspondence between the first user information and the first ARN identifier in the preset data table;

[0440] If the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid.

[0441] In some embodiments, the device is further configured to:

[0442] If the first ARN identifier is valid, determine the first path or first slice corresponding to the first ARN identifier according to the preset correspondence between the path or slice and the ARN identifier; map the second IP packet to the first path or the first slice;

[0443] The path or slice includes one of the following:

[0444] SRv6;

[0445] MPLS;

[0446] IPinIP;

[0447] VxLAN;

[0448] GRE;

[0449] GENEVE.

[0450] In practical applications, the receiving module 141 can be implemented by the communication interface in the information processing device.

[0451] It should be noted that the information processing device provided in the above embodiments is only illustrated by the division of the above program modules. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the information processing device and the information processing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0452] To implement the information processing method of this application embodiment, this application embodiment also provides an information processing device, which is set in the controller. Figure 15 This is a schematic diagram of the composition structure of the information processing device according to an embodiment of this application, as shown below. Figure 15 As shown, the device includes:

[0453] The second sending module 151 is used to send a first ARN identifier to the user boundary device; the first ARN identifier represents the application's calling relationship to network capabilities and / or the network's open capabilities to the application;

[0454] The first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet.

[0455] In some embodiments, the second sending module 151 is further configured to:

[0456] The preset correspondence between user information and ARN identifiers is sent to the network boundary device; and the preset correspondence between paths or slices and ARN identifiers is sent to the network boundary device.

[0457] The path or slice includes one of the following:

[0458] SRv6;

[0459] MPLS;

[0460] IPinIP;

[0461] VxLAN;

[0462] GRE;

[0463] GENEVE.

[0464] In some embodiments, the device is further configured to:

[0465] The first ARN identifier is assigned to the user boundary device based on user information, application information, and network service information.

[0466] Furthermore, according to at least one embodiment of this application, the method further includes: managing the lifecycle of the first ARN identifier.

[0467] In some embodiments, the device is further configured to:

[0468] Perform one of the following operations on the first ARN identifier:

[0469] Cancel;

[0470] Report the loss;

[0471] Replacement;

[0472] aging;

[0473] postpone.

[0474] In practical applications, the second sending module 151 can be implemented by the communication interface in the information processing device.

[0475] It should be noted that the information processing device provided in the above embodiments is only illustrated by the division of the above program modules. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the information processing device and the information processing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0476] This application also provides a user boundary device, such as... Figure 16 As shown, it includes:

[0477] The first communication interface 161 is capable of exchanging information with other user boundary devices;

[0478] The first processor 162, connected to the first communication interface 161, is used to execute the methods provided by one or more technical solutions on the user boundary device side when running a computer program. The computer program is stored in the first memory 163.

[0479] It should be noted that the specific processing procedures of the first processor 162 and the first communication interface 161 are detailed in the method embodiment and will not be repeated here.

[0480] Of course, in practical applications, the various components in user boundary device 160 are coupled together via bus system 164. It is understood that bus system 164 is used to implement communication between these components. In addition to a data bus, bus system 164 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 16 The general labeled all buses as Bus System 164.

[0481] The first memory 163 in this embodiment is used to store various types of data to support the operation of the user boundary device 160. Examples of such data include any computer program used to operate on the user boundary device 160.

[0482] The methods disclosed in the above embodiments of this application can be applied to the first processor 162, or implemented by the first processor 162. The first processor 162 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 162. The first processor 162 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 162 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 163. The first processor 162 reads the information in the first memory 163 and completes the steps of the aforementioned method in combination with its hardware.

[0483] This application also provides a network boundary device, such as... Figure 17 As shown, it includes:

[0484] The second communication interface 171 is capable of exchanging information with other user boundary devices;

[0485] The second processor 172, connected to the second communication interface 171, is used to execute the methods provided by one or more technical solutions on the network boundary device side when running a computer program. The computer program is stored in the second memory 173.

[0486] It should be noted that the specific processing procedures of the second processor 172 and the second communication interface 171 are detailed in the method embodiment and will not be repeated here.

[0487] Of course, in practical applications, the various components in network boundary device 170 are coupled together via bus system 174. It can be understood that bus system 174 is used to implement communication between these components. In addition to a data bus, bus system 174 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 17 The general labeled all buses as Bus System 174.

[0488] The second memory 173 in this embodiment is used to store various types of data to support the operation of the network border device 170. Examples of such data include any computer program used to operate on the network border device 170.

[0489] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the second processor 172. The second processor 172 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the software form of the second processor 172. The second processor 172 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 172 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically a second memory 173. The second processor 172 reads information from the second memory 173 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0490] This application also provides a controller, such as... Figure 18 As shown, it includes:

[0491] The third communication interface 181 is capable of exchanging information with other devices;

[0492] The third processor 182, connected to the third communication interface 181, is used to execute the methods provided by one or more technical solutions on the controller side when running a computer program. The computer program is stored in the third memory 183.

[0493] It should be noted that the specific processing procedures of the third processor 182 and the third communication interface 181 are detailed in the method embodiment and will not be repeated here.

[0494] Of course, in practical applications, the various components in controller 180 are coupled together via bus system 184. It can be understood that bus system 184 is used to implement communication between these components. In addition to a data bus, bus system 184 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 18 The general labeled all buses as Bus System 184.

[0495] The third memory 183 in this embodiment is used to store various types of data to support the operation of the controller 180. Examples of such data include any computer program used to operate on the controller 180.

[0496] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the third processor 182. The third processor 182 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware or by instructions in the software form of the third processor 182. The third processor 182 may be a general-purpose third processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The third processor 182 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose third processor may be a micro third processor or any conventional third processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as hardware decoding by the third processor, or as a combination of hardware and software modules in the decoding third processor. The software modules may be located in a storage medium, specifically a third memory 183. The third processor 182 reads information from the third memory 183 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0497] In an exemplary embodiment, the user boundary device 160, the network boundary device 170, and the controller 180 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned methods.

[0498] It is understood that the memories (first memory 163, second memory 173, and third memory 183) in the embodiments of this application can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0499] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory that stores a computer program. This computer program can be executed by the first processor 162 of the user boundary device 160 to complete the steps described in the aforementioned user boundary device-side method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0500] For example, this application also provides a computer program product, including a computer program that can be executed by a first processor 162 of a user boundary device 160 to complete the steps of any of the aforementioned methods, or by a second processor 172 of a network boundary device 170 to complete the steps of any of the aforementioned methods, or by a third processor 182 of a controller 180 to complete the steps of any of the aforementioned methods.

[0501] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0502] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0503] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. An information processing method, characterized in that, Applied to user boundary devices, the method includes: Obtain the first application response network ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the network capabilities include paths or slices, and the network's open capabilities to the application include paths or slices; The first Internet Protocol (IP) packet is marked based on the first ARN identifier to generate a second IP packet; The second IP packet is sent; the second IP packet is used by the network boundary device to obtain the first user information and the first ARN identifier, and to look up the correspondence between the first user information and the first ARN identifier in a preset data table. If the correspondence between the first user information and the first ARN identifier is found in the preset data table, the first ARN identifier is determined to be valid. If the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier; wherein, the preset data table stores a preset correspondence between user information and ARN identifier, and users, applications, network services and the first ARN identifier correspond one-to-one.

2. The method according to claim 1, characterized in that, The step of marking the first IP packet based on the first ARN identifier includes: Write the first ARN identifier and the first information into the flow label field and traffic type field in the header of the first IP packet, respectively; The first information is used to indicate whether the original content in the stream tag field is escaped into the first ARN identifier.

3. The method according to claim 1, characterized in that, The step of marking the first IP packet based on the first ARN identifier includes: Write the first ARN identifier into the extended header of the first IP packet; or, Write the first ARN identifier into the source address field of the header of the first IP packet.

4. The method according to claim 1, characterized in that, The process of obtaining the first ARN identifier includes: Obtain the first ARN identifier sent by the controller; The first ARN identifier is assigned to the user boundary device by the controller based on user information, application information, and network service information.

5. The method according to any one of claims 1 to 4, characterized in that, Sending the second IP packet includes: The first user information is carried in the second IP packet; Send the second IP message.

6. An information processing method, characterized in that, Applied to network boundary devices, the method includes: Receive the second IP message; in, The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the network capabilities include paths or slices, and the network's open capabilities to the application include paths or slices; The method further includes: Parse the second IP packet to obtain the first user information and the first ARN identifier; look up the correspondence between the first user information and the first ARN identifier in the preset data table; if the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid; if the first ARN identifier is valid, map the second IP packet to the corresponding path or slice based on the first ARN identifier; wherein, the preset data table stores a preset correspondence between user information and ARN identifier, and users, applications, network services and the first ARN identifier correspond one-to-one.

7. The method according to claim 6, characterized in that, The method further includes: If the verification result indicates that the first ARN identifier is invalid, perform the first operation; The first operation includes one of the following: Ignore the first ARN identifier carried in the second IP packet or discard the second IP packet; Reset the value of the first ARN identifier; Map the second IP packet to the default path or slice corresponding to the packet that does not carry the ARN identifier.

8. The method according to claim 6, characterized in that, The step of mapping the second IP packet to the corresponding path or slice based on the first ARN identifier includes: If the first ARN identifier is valid, determine the first path or first slice corresponding to the first ARN identifier according to the preset correspondence between the path or slice and the ARN identifier; map the second IP packet to the first path or the first slice; The path or slice includes one of the following: Policy-based IPv6 fragmentation routing (SRv6); Multiprotocol Label Switching (MPLS) Internet Layer 3 protocol IP-to-IP; Virtual Extended Local Area Network (VxLAN); Generic Routing Encapsulation Protocol (GRE) Geneve is a general-purpose network virtualization wrapper.

9. An information processing method, characterized in that, Applied to a controller, the method includes: Send a first ARN identifier to the user boundary device; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; Wherein, the first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet; the network capability includes paths or slices, and the network's open capabilities to applications include paths or slices; the second IP packet is used by the network boundary device to obtain the first user information and the first ARN identifier, look up the correspondence between the first user information and the first ARN identifier in a preset data table, and if the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid. If the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier; wherein, the preset data table stores a preset correspondence between user information and ARN identifiers, and users, applications, network services, and the first ARN identifier correspond one-to-one.

10. The method according to claim 9, characterized in that, The method further includes: The preset correspondence between user information and ARN identifiers is sent to the network boundary device; and the preset correspondence between paths or slices and ARN identifiers is sent to the network boundary device. The path or slice includes one of the following: SRv6; MPLS; IPinIP; VxLAN; GRE; GENEVE.

11. The method according to claim 9, characterized in that, The method further includes: The first ARN identifier is assigned to the user boundary device based on user information, application information, and network service information.

12. The method according to claim 9, characterized in that, The method further includes: Manage the lifecycle of the first ARN identifier.

13. The method according to claim 12, characterized in that, The management of the lifecycle of the first ARN identifier includes: Perform one of the following operations on the first ARN identifier: Cancel; Report the loss; Replacement; aging; postpone.

14. An information processing device, characterized in that, include: An acquisition module is used to acquire a first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the network capabilities include paths or slices, and the network's open capabilities to the application include paths or slices; The processing module is used to mark the first IP packet based on the first ARN identifier and generate a second IP packet; The first sending module is used to send the second IP packet; The second IP packet is used by the network boundary device to obtain the first user information and the first ARN identifier, and to look up the correspondence between the first user information and the first ARN identifier in a preset data table. If the correspondence between the first user information and the first ARN identifier is found in the preset data table, the first ARN identifier is determined to be valid. If the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier. The preset data table stores a preset correspondence between user information and ARN identifier, with a one-to-one correspondence between user, application, network service and the first ARN identifier.

15. An information processing device, characterized in that, include: The receiving module is used to receive the second IP packet; in, The second IP packet is obtained by the user boundary device acquiring the first ARN identifier and marking the first IP packet based on the first ARN identifier; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the network capabilities include paths or slices, and the network's open capabilities to the application include paths or slices; The device further includes: The processing module is used to parse the second IP packet to obtain the first user information and the first ARN identifier; to look up the correspondence between the first user information and the first ARN identifier in the preset data table; if the correspondence between the first user information and the first ARN identifier is found in the preset data table, the first ARN identifier is determined to be valid; if the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier; wherein, the preset data table stores a preset correspondence between user information and ARN identifier, and users, applications, network services and the first ARN identifier are one-to-one correspondences.

16. An information processing device, characterized in that, include: The second sending module is used to send a first ARN identifier to the user boundary device; the first ARN identifier represents the application's call relationship to network capabilities and / or the network's open capabilities to the application; the network capabilities include paths or slices, and the network's open capabilities to the application include paths or slices; Wherein, the first ARN identifier is used by the user boundary device to mark the first IP packet, generate a second IP packet, and send the second IP packet; the second IP packet is used by the network boundary device to obtain the first user information and the first ARN identifier, look up the correspondence between the first user information and the first ARN identifier in a preset data table, if the correspondence between the first user information and the first ARN identifier is found in the preset data table, then the first ARN identifier is determined to be valid, and if the first ARN identifier is valid, the second IP packet is mapped to the corresponding path or slice based on the first ARN identifier; wherein, the preset data table stores a preset correspondence between user information and ARN identifier, and users, applications, network services and the first ARN identifier correspond one-to-one.

17. A user boundary device, characterized in that, This includes a processor and memory for storing computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 5.

18. A network boundary device, characterized in that, This includes a processor and memory for storing computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 6 to 8.

19. A controller, characterized in that, This includes a processor and memory for storing computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 9 to 13.

20. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5, or implements the steps of the method according to any one of claims 6 to 8, or implements the steps of the method according to any one of claims 9 to 13.

21. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1 to 5, or implements the method according to any one of claims 6 to 8, or implements the method according to any one of claims 9 to 13.

Images