Message processing method and device, node, storage medium and computer program product

Abstract

The application discloses a message processing method and device, a node, a storage medium and a computer program product. The method comprises the following steps: a first node receives a first message, the first message comprises a first application response network identifier, and the first node comprises a boundary node of a first network; in a case that first information indicates that an application response network can be used on a first interface of the first node, performing a forwarding-related processing associated with the application response network on the first message on the first interface, or in a case that the first information indicates that the application response network is disabled on the first interface of the first node, performing a forwarding-related processing not associated with the application response network on the first message on the first interface.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network transmission, and in particular to a message processing method and device, a node, a storage medium and a computer program product. BACKGROUND

[0002] Application Responsive Networking (ARN) is a new application and network collaborative technology. By carrying an ARN identifier (also referred to as an ARN label) in a message of an application, the application can invoke a network path corresponding to the ARN identifier. Correspondingly, a network border device can identify the ARN identifier carried in the message after receiving the message, and forward the message according to the network path corresponding to the ARN identifier.

[0003] However, how to forward a message carrying an ARN identifier between network domains with different trustworthiness has not yet been effectively solved. SUMMARY

[0004] To solve the problems in the related art, the embodiments of the present application provide a message processing method and device, a node, a storage medium and a computer program product.

[0005] The technical solutions of the embodiments of the present application are implemented as follows.

[0006] The embodiments of the present application provide a message processing method, comprising:

[0007] A first node receives a first message, wherein the first message contains a first ARN identifier, and the first node comprises a border node of a first network;

[0008] In a case where the first information indicates that the first interface of the first node can use ARN, the first node performs ARN-associated forwarding-related processing on the first message at the first interface, or in a case where the first information indicates that the first interface of the first node disables ARN, the first node performs non-ARN-associated forwarding-related processing on the first message at the first interface.

[0009] In the above solution, the first message further contains second information, and the second information indicates a source of the first message; in a case where the first information indicates that the first interface of the first node can use ARN, the first node checks the second information and the first ARN identifier; after successful checking, the first node performs ARN-associated forwarding-related processing on the first message at the first interface.

[0010] In the scheme, the first packet further comprises second information, and the second information represents a source of the first packet; in a case where the first information represents that the first interface of the first node can use the ARN, the first node checks the second information and the first ARN identifier; after the checking fails, the first node performs a forwarding-related processing on the first packet which is not associated with the ARN on the first interface.

[0011] In the scheme, the checking of the second information and the first ARN identifier comprises:

[0012] The first node checks the second information and the first ARN identifier by using third information, and the third information represents a correspondence between source information of one or more packets and an ARN identifier.

[0013] In the scheme, the method further comprises:

[0014] The first node receives the third information sent by a control device.

[0015] Alternatively,

[0016] The first node determines the third information by route learning.

[0017] In the scheme, the second information comprises one or more of the following:

[0018] User information of the first packet;

[0019] Source address information of the first packet;

[0020] Port information of the first packet.

[0021] In the scheme, the forwarding-related processing on the first packet associated with the ARN comprises one of the following:

[0022] The first node sets a first field in the first packet carrying the first ARN identifier to a second ARN identifier to obtain a processed first packet, the second ARN identifier is associated with a second network, and the first node forwards the processed first packet to the second network;

[0023] The first node sets a first field in the first packet carrying the first ARN identifier to a third ARN identifier to obtain a processed first packet, the third ARN identifier is associated with a first network, and the first node forwards the processed first packet in the first network according to a first mode, the first mode is associated with the third ARN identifier;

[0024] The first node forwards the first packet to the second network, and the second network can forward packets in a second manner, and the second manner is associated with a second ARN identifier corresponding to the first packet;

[0025] The first node forwards the first packet in the first network in a third manner, and the third manner is associated with the first ARN identifier.

[0026] In the above scheme, the first node sets a first field carrying the first ARN identifier in the first packet to a second ARN identifier or a third ARN identifier by using fourth information, and the fourth information represents a corresponding relationship between one or more ARN identifiers associated with the first network and ARN identifiers associated with the second network.

[0027] In the above scheme, the method further comprises:

[0028] The first node receives the fourth information sent by the control device;

[0029] Alternatively,

[0030] The first node determines the fourth information through route learning.

[0031] In the above scheme, the processing of the first packet that is not associated with ARN includes one of the following:

[0032] The first node sets a first field carrying the first ARN identifier in the first packet to fifth information to obtain a processed first packet, and forwards the processed first packet in the first network in a fourth manner, and the fourth manner is not associated with ARN, and the fifth information represents that the first packet disables ARN;

[0033] The first node sets a first field carrying the first ARN identifier in the first packet to fifth information to obtain a processed first packet, and forwards the processed first packet to the second network, and the fifth information represents that the first packet disables ARN;

[0034] The first node discards the first packet.

[0035] Embodiments of the present application also provide a packet processing device arranged in a first node, and the first node includes a boundary node of a first network, and the device comprises:

[0036] A receiving unit is configured to receive a first packet, and the first packet contains a first ARN identifier;

[0037] The processing unit is configured to perform, at a first interface of the first node, forwarding-related processing associated with ARN on the first packet if the first information indicates that ARN is available at the first interface, or perform forwarding-related processing not associated with ARN on the first packet if the first information indicates that ARN is disabled at the first interface.

[0038] The embodiments of the present application also provide a node, which comprises a border node of a first network, and comprises:

[0039] The communication interface is configured to receive a first packet, wherein the first packet comprises a first ARN identifier.

[0040] The processor is configured to perform, at a first interface of the node, forwarding-related processing associated with ARN on the first packet if the first information indicates that ARN is available at the first interface, or perform forwarding-related processing not associated with ARN on the first packet if the first information indicates that ARN is disabled at the first interface.

[0041] The embodiments of the present application also provide a node, which comprises a processor and a memory for storing a computer program capable of running on the processor,

[0042] The processor is configured to execute the computer program to perform the steps of any of the above methods.

[0043] The embodiments of the present application also provide a storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to perform the steps of any of the above methods.

[0044] The embodiments of the present application also provide a computer program product comprising a computer program, wherein the computer program is executed by a processor to perform the steps of any of the above methods.

[0045] The packet processing method, device, node, storage medium and computer program product provided by the embodiments of the present application, a first node receives a first packet, the first packet contains a first ARN identifier, and the first node comprises a boundary node of a first network; in a case where first information indicates that a first interface of the first node can use ARN, performing a forwarding-related processing associated with ARN on the first packet at the first interface, or in a case where the first information indicates that the first interface of the first node disables ARN, performing a forwarding-related processing not associated with ARN on the first packet at the first interface. The scheme provided by the embodiments of the present application sets the first information in the first node at the boundary of the first network (which can also be understood as the network domain boundary of the first network), so that when the first node receives the first packet transmitted across the network domains (such as entering the first network or leaving the first network), the first node can determine whether to perform the forwarding-related processing associated with ARN on the first packet according to the first information. In this way, when the first node receives the first packet from a network with different trustworthiness from the first network, or when the first node forwards the first packet to a network with different trustworthiness from the first network, whether the interface related to the forwarding of the first packet in the first node can use ARN can be set, so that the packet carrying the ARN identifier can be forwarded between the network domains with different trustworthiness. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 FIG. 1 is a structural diagram of a packet header of an application-aware Internet Protocol version 6 networking (APN6) according to an embodiment of the present application;

[0047] Figure 2 FIG. 2 is a schematic diagram of a network architecture using the APN6 technology according to an embodiment of the present application;

[0048] Figure 3 FIG. 3 is a schematic diagram of another network architecture using the APN6 technology according to an embodiment of the present application;

[0049] Figure 4 FIG. 4 is a structural diagram of a packet header configured with an ARN ID according to an embodiment of the present application;

[0050] Figure 5 FIG. 5 is a flowchart of a packet processing method according to an embodiment of the present application;

[0051] Figure 6 FIG. 6 is a schematic diagram of a network architecture using the ARN technology according to an embodiment of the present application;

[0052] Figure 7 FIG. 7 is a flowchart of an access control method of an ARN ID according to an embodiment of the present application;

[0053] Figure 8 Figure 1 is a schematic diagram of a packet processing device structure according to an embodiment of the present application;

[0054] Figure 9 Figure 2 is a schematic diagram of a first node structure according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] The present application will be further described below with reference to the accompanying drawings and embodiments.

[0056] In the related art, a network usually adopts a best-effort forwarding mode to forward packets (which can also be understood as providing forwarding services). However, with the increasing types of services carried by the Internet, the best-effort forwarding mode has been difficult to meet the diversified forwarding service requirements of different applications (which can be expressed in English as APPs), and has become a major pain point in the development of networks.

[0057] In order to meet the diversified forwarding service requirements, technologies such as IPv6 segment routing (SRv6, Segment Routing IPv6), generalized SRv6 (G-SRv6, Generalized SRv6), and network slicing have emerged. However, the above technologies have failed to solve the problem of how to map different applications to corresponding network paths, that is, have failed to solve the problem of how to forward packets of different applications according to corresponding network paths. Here, the network path corresponding to the application can also be understood as a network path or a tunnel path that meets the service level agreement (SLA, Service Level Agreement) requirements of the application, and the network path can specifically include a network tunnel and / or a network slice, etc.

[0058] In the related art, a multi-protocol label switching (MPLS) technology enables a network to specify a forwarding network path according to message characteristics (such as congestion or quality of service (QoS) requirements, etc.) of different applications. However, the MPLS technology can only be applied in a limited trusted domain (also referred to as an MPLS domain) (also understood as running in a limited domain), at this time, a node (such as a router, etc.) located at the boundary of the MPLS domain discards all messages entering the MPLS domain from outside the MPLS domain. Therefore, the network in the MPLS domain (also understood as the network located inside the MPLS domain) is invisible to the outside (also understood as being regarded as a black box to the outside), that is, the MPLS technology can only enable the network to perceive messages of different applications (also understood as the network being able to perceive applications), but cannot enable applications to call network capabilities (also understood as applications perceiving network capabilities or application perceiving capabilities).

[0059] In actual application, if applications cannot call network capabilities, it is difficult to adjust the priority of message forwarding on demand and reasonably allocate network resources. For example, in a data express service, after the network receives a data message of an application, when the network can perceive the application but the application cannot call network capabilities, the network can only perceive different transmission protocols corresponding to different applications, and cannot further identify different priority requirements of applications with the same transmission protocol. In this case, the network may forward messages of an application with high priority requirements at a lower priority according to the order of receipt (similar to ordinary file transmission). When the network can perceive the application and the application can call network capabilities, different priority applications can call different network paths for message forwarding, thereby enabling the network to adjust the priority of message forwarding on demand and reasonably allocate network resources.

[0060] In the related art, in order to enable applications to call network capabilities, the network needs to open network capabilities to the outside, and in general, network capability opening can be realized through a northbound interface of a controller (also understood as a network controller or a control device). At this time, the application needs to call the controller to realize the calling of network capabilities. However, direct calling of the controller by the application may affect network security, and based on the security mechanism requirements of an operator network, the above scheme is generally difficult to be widely applied.

[0061] In the related art, in the IPv6+ technical system of SRv6, the APN6 technology is defined, which can be used for cooperation between applications and network capabilities. In the APN6 technology, a way of carrying application information in an IPv6 packet is defined; specifically, an APN6 header can be added in the IPv6 packet, and the application information is carried in the APN6 header. As shown in Figure 1 , the added APN6 header can specifically include APN identification (such as APN ID, which can specifically include application-group ID (APP-Group-ID), user-group ID (USER-Group-ID), reserved field, etc.), intent, APN parameter (APN-Para), and the like. The APN6 header can be used to indicate the application (or application group (which can also be understood as the class to which the application belongs)) information corresponding to the packet, the user (or user group) information using the application (or application group), the key flow (such as action instruction in cloud gaming, etc.) in the application, and the related parameters (such as bandwidth, delay, jitter, packet loss rate, etc.) of SLA requirements or network performance requirements, etc. The above information can also be collectively referred to as APN6 application information or APN6 information. In actual application, a plurality of applications can be grouped based on grouping rules to obtain a plurality of application groups. Here, the grouping rules of the application groups can be set based on the five-tuple information contained in the IPv6 packet, the QinQ information corresponding to the IPv6 packet, and the like.

[0062] In actual application, as shown in Figure 2 , in a network applying the APN6 technology, an application on an end-side device (such as a terminal, etc.) or a cloud-side device (such as a server, etc.) (the end-side device and the cloud-side device can also be collectively referred to as a user device) generates an IPv6 packet and sends the IPv6 packet to the network. At this time, the end-side device or the cloud-side device can set the APN6 application information corresponding to the application in the APN6 header of the IPv6 packet (which can also be understood as filling the APN6 application information or encapsulating the application feature information); after receiving the IPv6 packet, the network can identify the APN6 application information contained in the IPv6 packet, thereby perceiving the application corresponding to the APN6 application information, and the network can further map the IPv6 packet to the network path corresponding to the perceived application for forwarding (which can also be understood as forwarding the IPv6 packet according to the network path corresponding to the perceived application). In this way, the application can call the network capability corresponding to the APN6 application information by filling the APN6 application information in the packet, and the network can also identify the corresponding application according to the APN6 application information carried in the packet. At the same time, the application can achieve the calling of the network capability without directly calling the controller, which can meet the requirements of the operator on network security.

[0063] In actual application, as shown in Figure 3As shown, the network architecture applying the APN6 technology can specifically include:

[0064] 1) End-side device, cloud-side device: such as terminals, servers, etc. The end-side device or the cloud-side device can perceive the characteristic information of the application by applying the perception program, and then use the perceived characteristic information as the APN6 application information to generate the IPv6 packet containing the APN6 header, and send the generated IPv6 packet to the APN6 network domain (such as the SRv6 network domain applying the APN6 technology);

[0065] 2) Network edge device: such as the node at the boundary (also can be understood as the edge) of the APN6 network domain. When the end-side device or the cloud-side device does not have the application perception capability (i.e. cannot perceive the APN6 application information of the application), the end-side device or the cloud-side device cannot generate the IPv6 packet containing the APN6 header. At this time, the end-side device or the cloud-side device can send the IPv6 packet not containing the APN6 header to the network edge device, and the network edge device can parse the application characteristic information from the five-tuple information and the service information (such as the mapping relationship of the double VLAN (Virtual Local Area Network) tags (i.e. the mapping relationship of the customer VLAN (C-VLAN) and the service provider VLAN (S-VLAN)) contained in the IPv6 packet after receiving the IPv6 packet, and use the parsed application characteristic information as the APN6 application information to generate the IPv6 packet containing the APN6 header, and then forward the generated IPv6 packet to the network policy execution device;

[0066] 3) Network policy execution device: such as the node contained in the network path (also can be called the network service path) providing the packet forwarding service in the SRv6 network, which can specifically include:

[0067] Head node (also can be understood as the head node of the perception application): the starting node of the network path. The head node is used to maintain the matching relationship between the message traffic in the incoming direction (i.e., the direction of entering the APN6 network domain) and the network path. After the head node receives the IPv6 message from the network edge device, the head node can determine the network policy corresponding to the IPv6 message according to the corresponding relationship between the APN6 application information carried in the IPv6 message and the network policy (i.e., the routing policy for network forwarding service, which can also be called network service policy or routing policy), and select a network path for the IPv6 message according to the network policy (which can also be understood as matching the network path corresponding to the APN6 application information (i.e., the network path meeting the network performance requirements corresponding to the APN6 application information)), and forward the IPv6 message to the intermediate node corresponding to the matched network path (which can also be understood as introducing to the path meeting the requirements); at the same time, the head node can also encapsulate the APN6 application information into the outer (which can also be understood as the outer layer) IPv6 extension header (which can also be understood as path tunneling encapsulation), so that the intermediate node can obtain the APN6 application information from the outer IPv6 extension header, so as to further provide the perception application service in the SRv6 network (which can also be understood as enabling other nodes in the network to perceive the application information);

[0068] Intermediate node (also can be understood as the intermediate node of the perception application): one or more (one or more can also be understood as at least one) nodes between the head node and the tail node in the network path can be called intermediate nodes. The intermediate node can obtain the network path matched for the IPv6 message from the head node, so that after receiving the IPv6 message from the head node, the intermediate node can provide network forwarding service for the application IPv6 message according to the matched network path; at the same time, the intermediate node can also provide other network value-added services according to the APN6 application information carried in the IPv6 message, such as the service function chain (SFC, Service Function Chaining) of the perception application, the in-situ flow information telemetry (IFIT, In-situ Flow Information Telemetry) of the perception application, etc.;

[0069] Tail node (also can be understood as the tail node of the perception application): the terminal node of the network path. The tail node can delete (which can also be understood as remove) the APN6 application information and path tunneling encapsulation information contained in the IPv6 message; at the same time, the tail node can also retain (i.e., not delete) the APN6 application information already existing in the IPv6 message before the IPv6 message enters the path, and continue to transmit the retained APN6 application information with the IPv6 message;

[0070] 4) Controller: The controller can be used to plan and maintain the mapping relationship between the APN ID, the APN ID and the application (or application group), and the network policy. In the case of generating an IPv6 packet containing an APN6 header at the network edge device, the controller can distribute the APN ID and the mapping relationship to the network edge device and the network policy execution device. Specifically, the controller can distribute the mapping relationship between the application (or application group) and the APN ID to the network edge device; at the same time, the controller can distribute the mapping relationship between the APN ID and the network policy to the network policy execution device. In the case of generating an IPv6 packet containing an APN6 header at the end-side device or the cloud-side device (which can also be understood as the case of the application-side scheme), the controller can coordinate the APN ID corresponding to the application (or application group) through coordination with the Over-The-Top (OTT) application management server, and distribute it to the end-side device or the cloud-side device.

[0071] In actual application, although the APN6 technology realizes the calling of network capability by the application and the identification of the application by the network at the same time, the APN6 technology has a series of problems in privacy, security, management, and capacity. Specifically, they include:

[0072] In terms of privacy, the APN6 header of the IPv6 packet carries user information in plaintext, which is easy to leak user privacy;

[0073] In terms of security, the APN6 application information is only associated with the application, and there may be problems such as forging APN6 application information and imitating APN6 application information in the IPv6 packet; for example, after a user purchases an APN6 service, the controller allocates an APN ID corresponding to the application signed by the user to the user, and the APN ID is fixed and cannot be changed. At this time, if the APN ID is leaked (such as being intercepted by an illegal third party), in order to protect network security, it is necessary to comprehensively update all APN IDs saved in the router, which has a large maintenance burden;

[0074] In terms of management, there are a large number of applications, and a large number of new applications will be generated at any time, and it is actually impossible to uniformly encode (or allocate) the APN ID corresponding to these applications and manage (such as modify, delete, etc.) the APN ID corresponding to these applications;

[0075] In terms of capacity, there are hundreds of millions of applications at present, and the database storing the APN ID of all applications and the mapping relationship between the APN ID and the network policy occupies a large amount of capacity, and when the APN ID and the mapping relationship are distributed to the network boundary device, there is a great challenge to the capacity of the network boundary device.

[0076] Meanwhile, the network has limited access control on the APN6 application information, that is, the network can only limit the access (or access) behavior of the APN6 application information, and it is difficult to meet the complex needs of the network. Specifically, the extension header of the IPv6 message carries the APN6 application information, and usually the APN6 application information contained in the extension header (which can specifically include the extension header in addition to the hop-by-hop (HBH, Hop-By-Hop) header) cannot be changed (such as cannot be inserted, modified, deleted, etc.) in the forwarding process. Therefore, when the IPv6 message is transmitted between different network domains (which can also be understood as management domains), since the APN6 application information in different network domains can be different, it can cause the node located at the boundary of the network domain to discard the IPv6 message, which violates the principle of best effort forwarding of the Internet.

[0077] In other words, since the APN ID is uniformly allocated in the network, and the coding mode of the application information and user information contained in the APN6 application information can be different in different network domains. Therefore, when the message applying the APN6 technology is transmitted from one network domain to another network domain (that is, when it is transmitted across network domains), if the coding mode of the application information and user information in the two network domains is the same, the boundary node of the network domain receiving the message can accurately identify the APN6 application information contained in the message, and the boundary node can receive the message and forward the message in the network domain according to the APN6 application information; if the coding mode of the application information and user information in the two network domains is different, the boundary node of the network domain receiving the message cannot accurately identify the APN6 application information contained in the message, and the boundary node can only choose to discard the message, and cannot ignore the APN6 application information contained in the message and let the message be forwarded in the network domain.

[0078] For example, assuming that the border node of the metropolitan network connected with the user network of the home user is a broadband remote access server (BRAS), the BRAS can check the APN 6 application information contained in the received user sending packet by using the user information stored (or understood as configured) on the BRAS, if the APN 6 application information contained in the user sending packet is inconsistent with the user information stored on the BRAS (or understood as verification failure), the BRAS will discard the packet and no longer perform forwarding processing; if the APN 6 application information contained in the user sending packet is consistent with the user information stored on the BRAS (or understood as verification success), the BRAS can forward the packet in the metropolitan network according to the APN 6 application information, and deliver the packet to the backbone network, however, when the packet enters the network border (or understood as backbone edge) of the backbone network from the metropolitan network, the border node of the backbone network usually does not store any service information of the user, and therefore cannot effectively control and verify the APN 6 application information contained in the packet, which may cause the packet to be discarded by the border node of the backbone network or cause it difficult to select a suitable network path for the packet in the backbone network. Here, the cross-domain transmission can be realized by constructing an end-to-end network tunnel in the related art, however, there are nearly 300 million users in the current fixed network, and in the case of diversity of the destination flow of Internet access, it is necessary to construct hundreds of millions of end-to-end network tunnels in the network to meet the cross-domain transmission needs of a large number of users, and it is difficult to realize cross-domain transmission by constructing an end-to-end network tunnel.

[0079] In the related art, in order to avoid the problems of privacy, security, management, capacity, access control and the like existing in the APN6 technology, the ARN technology is proposed. The ARN technology generates ARN information (which can also be understood as application calling interface information, such as ARN ID) applied to a forwarding plane based on an algorithm parameter (such as a service type (English can be expressed as Color) parameter) of a control plane to implement network capability opening, that is, to implement application calling network capability. Specifically, when an application generates a packet, the ARN ID can be included in the header of the packet, so that the application can call the network capability corresponding to the ARN ID, and it can also be understood that the packet of the application can be forwarded in the network according to the routing strategy corresponding to the ARN ID; at the same time, when the network receives the packet, the corresponding application can be identified according to the ARN ID included in the header of the packet, and the packet is forwarded and processed according to the routing strategy matched with the ARN ID, such as when there are multiple network paths and / or multiple slices between the source address and the destination address corresponding to the packet, the network can select (which can also be understood as determine) one of the paths and / or slices according to the ARN ID included in the packet to perform forwarding processing. That is, the ARN ID can be understood as an intermediate layer between the application and the network, and by introducing the ARN ID, the bridging between the network requirements of the application and the network capabilities of the network is realized, and the ARN ID represents the network capability information opened to the outside of the network, as well as the application information and the user information. Each ARN ID can be represented by a number, which can include a randomly generated value or a value allocated in a predetermined order, and the structure of the ARN ID can be set according to actual needs, that is, the structure of the ARN ID is not limited, and therefore, the ARN ID can also be understood as an unstructured number.

[0080] In actual application, in the IPv6 packet, since the Flow Label field of the IPv6 packet header is designed to be flexible and modifiable, the ARN ID can be set in the Flow Label field; or the ARN ID can be set in the extension header of the IPv6 packet. Exemplarily, when the ARN ID is set in the Flow Label field of the IPv6 packet header, as Figure 4As shown, 20 bits of the Flow Label field can be reused to set the ARN ID, and the highest bit (specifically, the 7th bit) of the Traffic Class (TC) field is used to indicate whether the Flow Label field is escaped as the ARN ID. For example, when the highest bit of the TC field is set to 1, it indicates that the Flow Label field is escaped as the ARN ID; when the highest bit of the TC field is set to 0, it indicates that the Flow Label field is not escaped as the ARN ID. Of course, the highest bit of the TC field can also be set to 0 to indicate that the Flow Label field is escaped as the ARN ID, and the highest bit of the TC field is set to 1 to indicate that the Flow Label field is not escaped as the ARN ID. Here, in related technologies, the highest bit of the TC field can be set to represent Explicit Congestion Notification (ECN), and in the case of a wide area network, since ECN is not enabled, the above scheme of setting the highest bit of the TC field to indicate whether the Flow Label field is escaped as the ARN ID does not conflict with the scheme of setting the highest bit of the TC field to represent ECN in related technologies.

[0081] In actual applications, the application of ARN technology in network transmission can achieve the following advantages:

[0082] 1) Network security is ensured: network service providers can use different ARN IDs to represent different network capabilities opened to the outside to provide differentiated network services for users (such as providing low-latency, large-bandwidth tunnels and / or slices according to application requirements), without the need to directly open Segment Identifiers (SIDs) and / or Binding SIDs (BSIDs) to the outside, thereby effectively ensuring network security;

[0083] 2) User privacy is protected: since the ARN ID does not explicitly carry application information and user information, when the network receives a packet containing the ARN ID, the network cannot directly obtain the application information and user information from the ARN ID contained in the packet, and thus the ARN technology can avoid the leakage of user privacy;

[0084] 3) can realize flexible control and management of ARN ID: the controller can configure ARN ID for each network domain separately, so that when the message enters the network domain, the corresponding ARN ID of the network domain can be carried in the message, so that the nodes in the network domain can perform message forwarding processing in the network domain according to the ARN ID of the network domain carried in the message. That is, the ARN ID of each network domain can be flexibly configured and managed according to actual needs; at the same time, the ARN ID contained in the message can be changed according to the network domain to realize the calling of the network capability of the corresponding network domain. For example, in the case of cross-network domain transmission, assuming that the message is transmitted from network domain A to network domain B, the boundary node connected with network domain B in network domain A can replace the ARN ID corresponding to network domain A contained in the message with the ARN ID corresponding to network domain B, and send (also can be understood as transmit or deliver) the message to network domain B, so that the nodes in network domain B can perform forwarding processing in network domain B according to the ARN ID corresponding to network domain B contained in the message; or, network domain A directly sends the message to network domain B, and the boundary node connected with network domain A in network domain B receives the message, can replace the ARN ID corresponding to network domain A contained in the message with the ARN ID corresponding to network domain B, and perform subsequent forwarding processing in network domain B according to the replaced ARN ID. The above forwarding processing can also be referred to as ARN-associated forwarding-related processing.

[0085] However, in the scene of applying ARN technology, if the message is forwarded between two network domains with different trustworthiness, how to set the ARN information (such as ARN ID) in the message by the boundary node of the network domain and how to perform the forwarding-related processing are problems to be solved at present.

[0086] Therefore, in various embodiments of the present application, by setting the first information in the first node (also can be understood as the boundary node) of the first network boundary, when the first node receives the first message, it can determine whether to perform the ARN-associated forwarding-related processing on the first message according to the first information, so that when the first node receives the first message from the network domain with different trustworthiness from the first network, or when the first node forwards the first message to the network domain with different trustworthiness from the first network, it can realize the forwarding of the message carrying the ARN identifier between the network domains with different trustworthiness by setting whether the interface related to the forwarding of the first message in the first node can use the ARN.

[0087] The embodiment of the present application provides a message processing method applied to a first node, wherein the first node includes a boundary node of a first network, such as Figure 5 As shown in the figure, the method comprises:

[0088] Step 501: receiving a first packet, wherein the first packet contains a first ARN identifier;

[0089] Step 502: performing, at a first interface of the first node, ARN-associated forwarding-related processing on the first packet if the first information indicates that the first interface of the first node can use ARN, or performing non-ARN-associated forwarding-related processing on the first packet if the first information indicates that the first interface of the first node disables ARN.

[0090] Here, in actual application, the first network can specifically include one of a user network, a metropolitan area network, a backbone network, etc., and embodiments of the present application do not limit the specific implementation of the first network. The user network can also be understood as a network for connecting a user gateway device (such as a customer premise equipment (CPE) and the like) and a terminal, and the terminal can be referred to as a UE, a terminal device, a device, or a user, etc., and embodiments of the present application do not limit this.

[0091] The first node includes a border node of the first network, and can specifically include one of a CPE, a provider edge (PE) device (such as a virtual private network (VPN) edge router), a BRAS, a broadband network gateway (BNG), etc., and the first node can be connected with a second network, that is, the first network and the second network can be connected through the first node. The second network can specifically include one of a user network, a metropolitan area network, a backbone network, etc., and embodiments of the present application do not limit the specific implementation of the second network; the trustworthiness of the first network and the second network can not be the same, specifically, the trustworthiness of the first network can be higher than, equal to, or lower than the trustworthiness of the second network.

[0092] The first packet can specifically include an IPv6 packet, and the first ARN identifier contained in the first packet can specifically include an ARN ID. The first ARN identifier can be specifically set in a first field of the first packet, that is, the first field of the first packet carries the first ARN identifier. Specifically, the first field can specifically include a Flow Lable field of a packet header of the first packet.

[0093] The first interface includes an interface of the first node connected with the second network, and specifically can include an Internet Protocol (IP) interface. When the first node needs to send the first message to the second network, the message of the first node can be forwarded to the second network through the first interface, at this time, the first interface can also be understood as an out interface or an out interface; when the first node receives the first message from the second network, the first node can receive the first message from the second network through the first interface, at this time, the first interface can also be understood as an in interface or an in interface.

[0094] In actual application, in step 501, the first node can receive the first message from other nodes in the first network, and needs to forward the first message to the second network through the first interface; or the first node can receive the first message from the second network through the first interface, and needs to forward the first message in the first network.

[0095] After receiving the first message, the first node needs to determine how to forward the first message, which can also be understood as determining the service type of the forwarding service for the first message. Specifically, the service type of the forwarding service can be determined by one or more (one or more can also be understood as at least one) of a network path, a routing policy (which can also be understood as a routing policy, and specifically can include a Segment Routing Policy (SR Policy), etc.), a network tunnel, and / or a network slice.

[0096] Specifically, the first node can determine how to forward the first message according to the first information associated with the first interface. In actual application, the first information can be named as trust_arn, and of course can be named as other according to needs; since the first information is associated with the first interface, the first information can also be understood as interface-level attribute information; the first information can indicate whether the first interface can use the ARN, and whether the first interface can use the ARN is associated with the feasibility of the second network associated with the first interface. Specifically, when the second network is a trusted domain (which can also be understood as that the trustworthiness of the second network is greater than or equal to a trustworthiness threshold), the first interface can use the ARN, at this time, the first node can forward the first message in a manner associated with the ARN; when the second network is a non-trusted domain (which can also be understood as that the trustworthiness of the second network is less than the trustworthiness threshold), the first interface prohibits the use of the ARN, at this time, the first node can forward the first message in a manner not associated with the ARN.

[0097] Based on this, the value of the first information can be determined by whether the second network is a trusted domain. For example, assuming that the value of the first information is true or false, when the second network is a trusted domain, the value of the first information is true, indicating that the first interface of the first node can use ARN; when the second network is an untrusted domain, the value of the first information is false, indicating that the first interface of the first node disables ARN. Of course, when the second network is a trusted domain, the value of the first information can be false, indicating that the first interface of the first node can use ARN; when the second network is an untrusted domain, the value of the first information can be true, indicating that the first interface of the first node disables ARN.

[0098] In actual application, after determining the value of the first information according to whether the second network is a trusted domain, the value of the first information can be configured (or understood as set) in the first node. Specifically, the specific implementation of configuring the value of the first information in the first node can be selected according to actual needs, such as configuring the value of the first information in the first node by manual means (such as manually entering a command line), configuring the value of the first information in the first node by a control device, etc., which is not limited in the embodiments of the present application. Here, the control device can also be referred to as a controller or a network controller, which is at least used to generate an ARN identifier and configure an ARN identifier for a node in a network.

[0099] When the value of the first information is configured, after the first node receives a packet containing an ARN identifier, in step 502, the first node can determine how to perform forwarding-related processing on the packet according to the configured value of the first information.

[0100] Specifically, when the first information indicates that the first interface of the first node disables ARN, the first node performs forwarding-related processing on the packet that is not associated with ARN, which can include the following two ways.

[0101] The first way is that the first node directly discards the first packet. Based on this, in an embodiment, the forwarding-related processing on the first packet that is not associated with ARN includes:

[0102] The first node discards the first packet.

[0103] The second way is that the first node regards (or can be understood as regards) the first packet as a packet that does not contain an ARN identifier, and performs forwarding-related processing on the first packet according to the forwarding mode (or can be understood as the default forwarding mode) of the packet that does not contain an ARN identifier.

[0104] More specifically, in an embodiment, the performing the forwarding related processing on the first packet not associated with the ARN includes:

[0105] When the first interface is an ingress interface, setting a first field carrying the first ARN identifier in the first packet as fifth information to obtain a processed first packet, and forwarding the processed first packet in the first network in a fourth manner, the fourth manner not being associated with the ARN, the fifth information representing that the first packet disables the ARN; wherein the value of the fifth information can specifically include 0 or an invalid value, and the specific value of the fifth information can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0106] Here, if the first field is set as the fifth information, the first node forwards the first packet in the first network according to a default forwarding manner (i.e., the fourth manner), which can also be understood as providing a default network service for the first packet;

[0107] When the first interface is an ingress interface, setting a first field carrying the first ARN identifier in the first packet as fifth information to obtain a processed first packet, and forwarding the processed first packet in the first network in a fourth manner, the fourth manner not being associated with the ARN, the fifth information representing that the first packet disables the ARN; wherein the value of the fifth information can specifically include 0 or an invalid value, and the specific value of the fifth information can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0108] Here, if the first field is set as the fifth information, the first node does not perform any processing, and directly forwards the first packet to the second network.

[0109] As can be seen from the above description, in the case that the first information represents that the first interface of the first node disables the ARN, that is, in the case that the first network is a non-trusted domain, the first node can discard the first packet or modify the first ARN identifier contained in the first packet to an invalid value in the case that the second network associated with the first interface is a non-trusted domain, thereby avoiding the first ARN identifier from being leaked to the non-trusted domain, and network security can be ensured.

[0110] Correspondingly, in the case that the first information represents that the first interface of the first node can use the ARN, the first node performs the forwarding related processing on the packet associated with the ARN. Meanwhile, in order to avoid network security problems caused by imitating the ARN identifier, before step 502, the first node can also verify the ARN identifier contained in the first packet and the source of the first packet, and determine whether to perform the forwarding related processing associated with the ARN according to the verification result.

[0111] Based on this, in an embodiment, the first packet further comprises second information, the second information representing the source of the first packet; in the case that the first information represents that the first interface of the first node can use ARN, the second information and the first ARN identifier are checked; after successful checking, the first interface performs forwarding-related processing associated with ARN on the first packet; correspondingly, after failed checking, the first interface performs forwarding-related processing not associated with ARN on the first packet.

[0112] In an embodiment, the second information can include one or more of the following (one or more can also be understood as at least one):

[0113] User information of the first packet;

[0114] Source address information of the first packet;

[0115] Port information of the first packet.

[0116] Here, in actual application, when the first packet comes from a user network, the second information can include user information of the first packet, that is, the second information can represent which user the first packet comes from. At this time, the user information can specifically include a user identifier, access link information of the first packet, etc. When the user information includes the access link information of the first packet, the first node can determine which access link the first packet is sent to the first node through according to the access link information of the first packet, and then determine which user the first packet comes from according to the corresponding relationship between the access link and the user, here, the first node can pre-know the corresponding relationship between the access link and the user; when the first packet comes from a metropolitan area network or a backbone network, the second information can include source address information (such as source IP address information) of the first packet and / or port information (such as source port information) of the first packet.

[0117] In actual application, the first node can obtain a corresponding relationship between source information of one or more packets and an ARN identifier, match the second information included in the first packet and the first ARN identifier in the obtained corresponding relationship, and when there is a matching item, determine that the checking is successful; when there is no matching item, determine that the checking is failed.

[0118] Based on this, in an embodiment, the checking of the second information and the first ARN identifier includes:

[0119] The second information and the first ARN identifier are checked by using third information, the third information representing a corresponding relationship between source information of one or more packets and an ARN identifier.

[0120] The third information can be in the form of a mapping table, and the third information can also be referred to as a check table. The third information is associated with the first interface, that is, when the first node is connected to multiple networks through multiple interfaces, each interface corresponds to a third information, which is used to check the second information and the ARN identifier contained in the packet associated with the interface.

[0121] In an embodiment, the first node can obtain the third information in the following ways: the first node receives the third information sent by a control device, manually configures the third information on the first node, the first node performs routing learning on a routing protocol using all received packets containing ARN identifiers to determine the third information (i.e., the third information is determined by routing learning), and the first node uses an access control list (ACL) corresponding to the first node as the third information, and the like. The routing protocol can include a border gateway protocol (BGP) or an interior gateway protocol (IGP), and the IGP can further include an open shortest path first (OSPF) protocol or an intermediate system to intermediate system (ISIS) protocol. The routing protocol can be configured by any node that transmits the first packet before the first node.

[0122] In actual applications, if the check fails, the first node can perform non-ARN-associated forwarding-related processing on the first packet in step 502. The specific implementation of the non-ARN-associated forwarding-related processing has been described above, and will not be repeated here. If the check succeeds, the first node can perform ARN-associated forwarding-related processing on the first packet in step 502. At this time, the ARN-associated forwarding-related processing can be discussed in the following four cases according to whether the first interface is an ingress interface or an egress interface and whether the first node needs to reset the ARN identifier contained in the first packet (which can also be understood as performing ARN ID mapping):

[0123] In a first case, when the first interface is an out interface and the first node needs to reset the ARN identifier contained in the first packet, after receiving the first packet, the first node can map (or reset or replace) the first ARN identifier associated with the first network contained in the first packet to an ARN identifier associated with the second network, and forward the first packet after mapping to the second network, so that the second network can forward the first packet in the second network according to the ARN identifier after mapping (or provide a network service corresponding to the ARN identifier after mapping for the first packet in the second network).

[0124] Based on this, in an embodiment, the processing of the first packet related to the forwarding associated with the ARN includes:

[0125] setting a first field carrying the first ARN identifier in the first packet to a second ARN identifier to obtain a processed first packet, the second ARN identifier being associated with the second network, and forwarding the processed first packet to the second network;

[0126] In this embodiment, the first node can obtain a corresponding relationship between one or more first ARN identifiers and second ARN identifiers, so that the first node can determine the second ARN identifier corresponding to the first packet by using the corresponding relationship and the first ARN identifier contained in the first packet, and then realize the setting of the first field to the second ARN identifier determined.

[0127] Based on this, in an embodiment, the fourth information is used to set the first field carrying the first ARN identifier in the first packet to a second ARN identifier, or set the first field carrying the first ARN identifier in the first packet to a third ARN identifier, the fourth information representing a corresponding relationship between one or more ARN identifiers associated with the first network and ARN identifiers associated with the second network.

[0128] In an embodiment, the first node can obtain the fourth information in one of the following ways: the first node receives the fourth information sent by a control device, the fourth information is configured in the first node by manual means, the first node uses all received packets containing ARN identifiers to perform routing learning on a routing protocol, and thus determines the fourth information (i.e., determines the fourth information by routing learning), and the like.

[0129] In the second case, when the first interface is an out-bound interface and the first node does not need to reset the ARN identifier contained in the first packet, the first node can directly forward the received first packet to the second network. After receiving the first packet, the border node of the second network can map the first ARN identifier associated with the first network and contained in the first packet to an ARN identifier associated with the second network, so that the border node of the second network can forward the first packet in the second network according to the mapped ARN identifier.

[0130] Based on this, in an embodiment, the processing of the first packet in association with the forwarding related to the ARN includes:

[0131] forwarding the first packet to the second network, wherein the second network can forward packets in a second manner, and the second manner is associated with a second ARN identifier corresponding to the first packet;

[0132] In the third case, when the first interface is an in-bound interface and the first node needs to reset the ARN identifier contained in the first packet, after receiving the first packet from the second network, the first node can map the first ARN identifier associated with the second network and contained in the first packet to an ARN identifier associated with the first network, and forward the first packet in the first network according to the mapped ARN identifier.

[0133] Based on this, in an embodiment, the processing of the first packet in association with the forwarding related to the ARN includes:

[0134] setting a first field carrying the first ARN identifier in the first packet to a third ARN identifier to obtain a processed first packet, the third ARN identifier is associated with the first network, and the processed first packet is forwarded in the first network in a first manner, the first manner is associated with the third ARN identifier;

[0135] In the fourth case, when the first interface is an in-bound interface and the first node does not need to reset the ARN identifier contained in the first packet, after receiving the first packet from the second network, the first node can directly forward the first packet in the first network according to the first ARN identifier associated with the first network and contained in the first packet. Before the border node of the second network sends the first packet to the first node, the border node of the second network has mapped an ARN identifier associated with the second network and contained in the first packet to the first ARN identifier associated with the first network.

[0136] Based on this, in an embodiment, the processing of the first packet in association with the forwarding related to the ARN includes:

[0137] forwarding the first packet in a third manner, the third manner being associated with the first ARN identification.

[0138] From the above description, it can be seen that the first node can check the source of the first packet and the first ARN identification by using the third information, and perform forwarding related processing on the first packet according to the check result.

[0139] In actual application, the third information and the fourth information can be merged, and the merged information can realize the functions of the third information and the fourth information. Based on this, when the first node is configured with the third information and the fourth information at the same time, the first node can only store the merged information, and realize the functions of the third information and the fourth information by using the merged information. Since the merged information occupies a smaller storage space, storage resources can be saved. At the same time, if the first node is simultaneously configured with the ACL and the third information, the first node can preferentially check the source of the first packet and the first ARN identification by using the ACL when performing the check, that is, the check priority of the ACL is the highest. Illustratively, when the check result obtained by using the ACL is inconsistent with the check result obtained by using the third information, the check result corresponding to the ACL can be used as the reference.

[0140] The packet processing method provided by the embodiment of the present application, the first node receives a first packet, the first packet contains a first ARN identification, and the first node includes a boundary node of a first network; in a case that first information indicates that a first interface of the first node can use ARN, performing forwarding related processing associated with ARN on the first packet at the first interface, or in a case that the first information indicates that the first interface of the first node disables ARN, performing forwarding related processing not associated with ARN on the first packet at the first interface. The scheme provided by the embodiment of the present application, by setting the first information in the first node at the boundary of the first network (which can also be understood as the network domain boundary of the first network), when the first node receives the first packet transmitted across the network domains (such as entering the first network or leaving the first network), the first node can determine whether to perform forwarding related processing associated with ARN on the first packet according to the first information. In this way, when the first node receives the first packet from a network with different trustworthiness from the first network, or when the first node forwards the first packet to a network with different trustworthiness from the first network, whether the interface related to the forwarding of the first packet in the first node can use ARN can be used to realize the forwarding of the packet carrying the ARN identification between the network domains with different trustworthiness.

[0141] The present application will be further described in detail in conjunction with application examples.

[0142] The application example provides a network architecture applying ARN technology, as shown in the figure, the network architecture comprises a controller (namely the control device), a user network, a metropolitan area network and a backbone network. Figure 6 As shown in the figure, the user network is connected with the metropolitan area network, and the metropolitan area network is connected with the backbone network. Exemplarily, the CPE of the user network is connected with the BRAS of the metropolitan area network, and the metropolitan area boundary node (which can also be understood as a metropolitan area boundary device) of the metropolitan area network is connected with the PE of the backbone network. The user network, the metropolitan area network and the backbone network can also be understood as different network domains, and the trustworthiness between different network domains can be different.

[0143] In actual application, the ARN ID (i.e. the ARN identifier described above) is mainly applied to a network boundary node (which can also be understood as a network boundary service access point, such as a PE, a BRAS, or a BNG, etc.). When the controller receives order information (which can also be understood as a subscription demand for a network service) of a user subscribing to an ARN service, the controller can set one or more service types corresponding to the order information according to the received order information; for each service type, the controller can determine a routing policy for forwarding a packet corresponding to the service type in a metropolitan area network connected to a user network corresponding to the user according to an SR Policy, i.e. determine a routing policy for forwarding a packet corresponding to the service type in the metropolitan area network (the routing policy is associated with a network path for forwarding the packet, and the network path can specifically include a network slice and / or a network tunnel, etc.). After determining the routing policy corresponding to the service type, for the routing policy, if the routing policy already has a corresponding ARN ID, the controller can directly determine a correspondence between the service type and the ARN ID (which can also be expressed in the form of a binary tuple, such as <service type, ARN ID>) and a correspondence between the ARN ID and the routing policy (which can also be expressed in the form of a binary tuple, such as <ARN ID, routing policy>); if the routing policy does not yet have a corresponding ARN ID, the controller can generate an ARN ID corresponding to the routing policy according to a preset policy (such as negotiation with an application management server, etc.), and then determine the correspondence between the service type and the ARN ID and the correspondence between the ARN ID and the routing policy; after determining the two correspondences, the controller can distribute the correspondence between the service type and the ARN ID to a user device (such as a terminal, a server, a CPE, etc.), so that the user device can determine an ARN ID corresponding to a packet according to a service type corresponding to the packet and the correspondence when generating the packet, and carry the determined ARN ID in the packet; at the same time, the controller can distribute the correspondence between the ARN ID and the routing policy to a boundary node (such as a BRAS) in the metropolitan area network connected to the user network corresponding to the user, so that the BRAS can determine a routing policy for forwarding the packet (which can also be understood as a network forwarding service provided for the packet) according to the ARN ID contained in the packet and the correspondence when the packet of the user enters the metropolitan area network, and the process of distributing the correspondence by the controller can also be understood as network side configuration.

[0144] Exemplarily, assuming that the controller issues the correspondence between the service type and the ARN ID to the terminal and / or the server, the application on the terminal and / or the server can carry the ARN ID corresponding to the service type required by the application in the message generated by the application according to the service type required by the application and the correspondence, so that the CPE of the user network can directly forward the message carrying the ARN ID to the metropolitan area network when receiving the message sent by the terminal and / or the server; assuming that the controller issues the correspondence between the service type and the ARN ID to the CPE, the message generated by the terminal and / or the server can not carry the ARN ID, and the CPE can classify (or can also be understood as performing flow distribution) the message by using the ACL and the like after receiving the message sent by the terminal and / or the server, so as to determine the service type required by the message, and carry the ARN ID corresponding to the service type required by the message in the message according to the service type required by the message and the correspondence, and then forward the message to the metropolitan area network.

[0145] Based on the network architecture, the application example provides an access control method of ARN ID, as shown in the following. Figure 7 The method comprises the following steps:

[0146] Step 701: A network border device (i.e., the first node) receives a message (i.e., the first message) containing an ARN ID (i.e., the first ARN identifier);

[0147] In actual application, the network border device can specifically include one of the CPE of the user network, the metropolitan border device of the metropolitan area network, the BRAS of the metropolitan area network, the PE of the backbone network and the like.

[0148] Step 702: The network border device performs forwarding processing on the message according to the ARN trustworthiness attribute (trust_arn) corresponding to the interface (i.e., the first interface, which can specifically include an IP interface) connected with the adjacent network (i.e., the second network); wherein the forwarding processing comprises:

[0149] When the value of trust_arn is false, the ARN service is disabled during the forwarding of the message;

[0150] When the value of trust_arn is true, step 703 is performed;

[0151] Here, the adjacent network refers to the network adjacent to the network to which the network border device belongs, and exemplarily, as shown in the following. Figure 6As shown, the adjacent network of the metropolitan area network includes a user network and a backbone network. When the network boundary device needs to forward the received packet to the adjacent network, the interface can also be referred to as an out interface; when the network boundary device receives the packet from the adjacent network and needs to forward it within the network to which the network boundary device belongs, the interface can also be referred to as an in interface.

[0152] In actual application, trust_arn is an interface-level attribute, which can be set in the network boundary device in advance according to the trust relationship between the network to which the network boundary device belongs and the adjacent network (which can also be understood as whether the adjacent network is a trusted domain relative to the network to which the network boundary device belongs) by one of manual or controller issuing. The value of trust_arn can be set to true or false.

[0153] In actual application, the disabled ARN service means that the network boundary device forwards the packet as a packet without carrying an ARN ID, such as discarding the packet or forwarding the packet according to a default routing strategy. Specifically, when the value of trust_arn is false, after the network boundary device receives a packet containing an ARN ID (which can also be understood as a packet carrying ARN information), the value of the field (such as the Flow Lable field) carrying the ARN ID in the packet can be set to 0 (which can also be understood as being erased to 0) or an invalid value (which can be selected according to actual needs). In this way, the network boundary device can forward the packet containing an ARN ID of 0 or an invalid value as a packet without an ARN ID.

[0154] Step 703: The network boundary device performs legality verification on the user information and the ARN ID contained in the packet;

[0155] If the verification is successful, step 704 is performed;

[0156] If the verification fails, the ARN service is disabled;

[0157] Here, when the interface is an out interface, the legality verification can also be referred to as ARN out direction verification or out direction verification; when the interface is an in interface, the legality verification can also be referred to as ARN in direction verification or in direction verification.

[0158] In actual application, in order to avoid third parties (such as users who do not subscribe to the ARN service) from impersonating ARN IDs in sent messages, the network boundary device can obtain a verification table (i.e., the third information described above) for verifying the identity of a user. In this way, when the network boundary device receives a message from a user, the network boundary device can use the verification table to verify the ARN ID contained in the message and the user information corresponding to the message, thereby avoiding impersonation. The verification table can be used for outbound verification and / or inbound verification. A verification table used for outbound verification can also be referred to as an outbound verification table. A verification table used for inbound verification can also be referred to as an inbound verification table.

[0159] In actual application, the network boundary device can obtain the verification table in one of the following ways: manual configuration, controller issuance, and route learning. For example, when the network boundary device obtains the verification table through controller issuance, the specific implementation can include the following steps. The controller determines the source address information (such as the source IP) and / or link information of a user according to the subscription information of the user, and uses the source address information and / or link information of the user as the user information (which can also be understood as the identification information of the user, i.e., the source information described above). In this way, the controller can determine, for each user, the correspondence between the user information of the user and the ARN ID corresponding to the service type subscribed by the user. It can also be understood that the message of the user can contain which ARN IDs (which can also be expressed in the form of a binary tuple, such as <user information, ARN ID>). The controller can then determine the verification table according to the correspondence between the user information of all users and the ARN IDs, and issue the verification table to the network boundary device.

[0160] For example, assuming that the network boundary device is a boundary device of a user network (such as a CPE or the like) or a boundary device of a neighboring network connected to the user network (such as a BRAS, a BNG, or the like), the network boundary device can determine the user information according to the received message, such as determining the user information according to the access link information corresponding to the message. At the same time, the network boundary device can determine the ARN ID contained in the received message. In this case, the network boundary device can also be referred to as a user gateway device. Alternatively, assuming that the network boundary device is a boundary device of a metropolitan area network connected to a backbone network (such as a metropolitan boundary device, a PE, or the like), the network boundary device can determine the user information according to the source IP information or port information contained in the message, and determine the ARN ID contained in the message. In this case, the network boundary device can also be referred to as a network gateway device. In this way, after determining the user information and the ARN ID, the network boundary device can perform legitimacy verification on the message according to the determined user information, the ARN ID, and the verification table issued by the controller.

[0161] In actual application, when performing the in-coming check, the ARN ID contained in the message received by the network boundary device can be associated with the adjacent network. At this time, the network boundary device needs to map (or can be understood as replace, rewrite, update, etc.) the ARN ID contained in the message, so that the mapped ARN ID is associated with the network to which the network boundary device belongs. In this way, the network boundary device can forward the message in the network to which the network boundary device belongs according to the ARN ID contained in the message. Correspondingly, when performing the out-coming check, the ARN ID contained in the message received by the network boundary device is associated with the network to which the network boundary device belongs. The network boundary device can map the ARN ID contained in the message, so that the mapped ARN ID is associated with the adjacent network. In this way, after the network boundary device forwards the message to the adjacent network, the adjacent network can directly forward the message in the adjacent network according to the ARN ID contained in the message.

[0162] In actual application, since the controller allocates ARN IDs for the network to which the network boundary device belongs and the adjacent network respectively, the network boundary device can obtain the corresponding relationship (or can be understood as mapping relationship, that is, the fourth information described above) between the ARN ID of the network to which the network boundary device belongs and the ARN ID of the adjacent network, so as to map the ARN ID contained in the message. The corresponding relationship can be specifically presented in the form of a mapping table. The mapping table can be used for out-coming check and / or in-coming check. The mapping table used for out-coming check can also be referred to as an out-coming mapping table. The mapping table used for in-coming check can also be referred to as an in-coming mapping table.

[0163] In actual application, the network boundary device can obtain the mapping table by one of manual configuration, controller issuing, and route learning. For example, assuming that the adjacent network is a backbone network and the network to which the network boundary device belongs is a metropolitan area network, when the network boundary device obtains the mapping table by the controller issuing, the specific implementation can include: the controller determines the corresponding relationship between the ARN ID allocated for the metropolitan area network and the ARN ID allocated for the backbone network according to the corresponding relationship between the routing strategy in the metropolitan area network and the routing strategy in the backbone network (or can be understood as the message forwarded in the metropolitan area network by each routing strategy should be provided with network forwarding service in the backbone network by which routing strategy); the controller can further determine the mapping table according to the corresponding relationship of all ARN IDs, and issue the mapping table to the boundary device. In this way, flexible access control can be realized on the ARN ID contained in the message during forwarding the message between different networks.

[0164] In actual application, the check table and the mapping table obtained by the network boundary device can be merged (here, the merging can be performed in the controller when the check table and the mapping table are issued by the controller) to obtain a merged table. At this time, the network boundary device can perform legality check on the packet according to the determined user information, the ARN ID and the merged table, and map the ARN ID contained in the packet to an ARN ID (i.e. a destination ARN ID) associated with the network to which the network boundary device belongs. The merged table can be expressed in the form of a triple, such as <user information, ARN ID, destination ARN ID>. The ARN ID is associated with the network to which the network boundary device belongs, and the destination ARN ID is associated with the adjacent network.

[0165] Exemplarily, the ingress check table and the ingress mapping table obtained by the network boundary device can be merged, and the egress check table and the egress mapping table can also be merged. As shown in Figure 6 The ingress check table of the user-oriented interface of the CPE (which can also be understood as a terminal-oriented and / or server-oriented interface) can be expressed as <user information, ARN ID>, and the egress check table can be expressed as <source IP, ARN ID>. The ingress check table and the egress check table of other interfaces of the CPE and other network boundary devices (including BRAS, PE, metropolitan area network boundary device, etc.) can both be expressed as <source IP, ARN ID>. The ingress mapping table of the user-oriented interface of the CPE can be expressed as <user, ARN ID, destination ARN ID>, and the egress mapping table can be expressed as <source IP, ARN ID, destination ARN ID>. The ingress mapping table and the egress mapping table of other interfaces of the CPE and other network boundary devices can both be expressed as <source IP, ARN ID, destination ARN ID>.

[0166] In actual application, when the ACL, the check table and the mapping table all have the same ARN ID (i.e. the information related to one ARN ID exists in the ACL, the check table and the mapping table at the same time), the network boundary device preferentially uses the ACL to perform legality check on the ARN ID. When the information related to the ARN ID does not exist in the ACL, the network boundary device can use the check table to perform legality check on the ARN ID. When the information related to the ARN ID does not exist in the ACL and the check table, the network boundary device can use the mapping table to perform legality check on the ARN ID. That is, the network boundary device can perform legality check on the ARN ID according to the priority order of ACL>check table>mapping table.

[0167] Step 704: The network boundary device performs the forwarding processing associated with the ARN, which includes one of the following:

[0168] If the interface is an ingress interface, the network boundary device determines a routing policy according to the ARN ID contained in the packet and a correspondence relationship between the ARN ID issued by the controller and the routing policy, and forwards the packet according to the determined routing policy; or the network boundary device maps the ARN ID contained in the packet to an ARN ID associated with a network to which the network boundary device belongs according to the mapping table, and determines a routing policy according to the mapped ARN ID and the correspondence relationship between the ARN ID issued by the controller and the routing policy, and forwards the packet according to the determined routing policy; wherein forwarding the packet according to the determined routing policy comprises mapping the packet to a network tunnel and / or a network slice corresponding to the routing policy.

[0169] If the interface is an egress interface, the network boundary device maps the ARN ID contained in the packet to an ARN ID associated with a neighboring network according to the mapping table, and forwards the packet to the neighboring network; or the network boundary device directly forwards the packet to the neighboring network.

[0170] In actual application, when the network boundary device directly forwards the packet to the neighboring network, the boundary device of the neighboring network can map the ARN ID contained in the packet to an ARN ID associated with the neighboring network according to the mapping table, so that the boundary device of the neighboring network can forward the packet in the neighboring network according to the ARN ID associated with the neighboring network.

[0171] The scheme provided by the application examples can identify a neighboring network connected by a network boundary device as a trusted domain or an untrusted domain through a trust_arn attribute at an IP interface level of the network boundary device, so that the network boundary device can perform forwarding processing on a packet containing an ARN ID according to a value of the trust_arn. That is, even if the network boundary device connects an untrusted domain, the packet can be processed accordingly, that is, a basic security framework for constructing a network capability of calling a trusted domain from an untrusted domain is realized.

[0172] Meanwhile, when the trust_arn of the IP interface is false, the network boundary device can disable the ARN service as a whole, at this time, if a packet entering or leaving the interface carries ARN information, the network boundary device can overwrite the ARN ID as 0 or set it to an invalid value, and process the packet as a packet without carrying ARN information;

[0173] When the trust_arn of the IP interface is true, if the network boundary device receives a message with an invalid ARN ID, such as an ARN ID of 0 or an invalid value, the network boundary device processes the message as a message without ARN information (i.e., disables the ARN service).

[0174] When the trust_arn of the IP interface is true, and the network boundary device is a user gateway device and the IP interface is an ingress interface, the user gateway device can match (or can be understood as query) a <user, ARN ID> two-tuple in a check table and / or a mapping table according to the message containing user information and the ARN ID. If there is a matching item, the user gateway device can map and forward the message for network tunneling and / or network slicing, or can first map the ARN ID contained in the message to a destination ARN ID, and then map and forward the message for network tunneling and / or network slicing. If there is no matching item, the user gateway device can overwrite the ARN ID contained in the message to 0 or set it to an invalid value, and process the message as a message without ARN information.

[0175] When the trust_arn of the IP interface is true, and the network boundary device is a network gateway device and the IP interface is an ingress interface, if the ARN ID of the message is valid, the network gateway device matches a <user information (such as a user or a source IP), ARN ID> two-tuple in a check table and / or a mapping table. If there is a matching item, the network gateway device can directly map and forward the message for network tunneling and / or network slicing, or can first map the ARN ID contained in the message to a destination ARN ID, and then map and forward the message for network tunneling and / or network slicing. If there is no matching item, the network gateway device overwrites the ARN ID contained in the message to 0 or sets it to an invalid value, or retains the ARN ID (i.e., does not change the ARN ID contained in the message), and then maps and forwards the message for network tunneling and / or network slicing.

[0176] When the trust_arn of the IP interface is true and the IP interface is an out-bound interface, if the ARN ID of the packet is valid, the network border device matches the <user information (such as a user or a source IP), ARN ID> two-tuple in a checking table and / or a mapping table, if there is a matching item, the network border device can directly forward the packet to a neighboring network, or first maps the ARN ID contained in the packet to a destination ARN ID, and then forwards the packet to the neighboring network; if there is no matching item, the network border device can overwrite the ARN ID contained in the packet as 0 or set it as an invalid value, or retains the ARN ID (that is, does not change the ARN ID contained in the packet), and then forwards the packet to the neighboring network.

[0177] Therefore, the scheme provided by the application examples has the following advantages:

[0178] In terms of application privacy, since the ARN ID is a random value and does not carry application privacy information, and can be mapped to a slice and / or a tunnel of a network, the security of the application can be ensured; meanwhile, the ARN can encapsulate internal network privacy information, avoiding the problem of internal network information leakage caused by the direct use of SRv6 Policy or BSID by a user;

[0179] In terms of business functions, by defining a trusted domain and an untrusted domain at an interface of a network border device, when the network connected by the interface is an untrusted domain, the network border device can completely ignore the ARN (that is, disable the ARN service); when the network connected by the interface is a trusted domain, the network border device can not discard the packet when the ARN ID contained in the packet does not have a matching item (that is, the network border device does not recognize the ARN ID contained in the packet), and map the packet to a default tunnel and / or slice (that is, provide a default network forwarding service for the packet);

[0180] In terms of device capacity, since the network border device only needs to store the ARN related information (such as an ARN ID, a checking table, a mapping table, etc.) of a network to which the network border device belongs and a neighboring network, and does not need to store the information of a global network, the occupied storage space is small, and the requirement for device capacity is low.

[0181] In order to implement the method of the application embodiment, the application embodiment further provides a packet processing device arranged at a first node, as shown in Figure 8 The device comprises:

[0182] A receiving unit 801 is configured to receive a first packet, wherein the first packet contains a first ARN identifier.

[0183] The processing unit 802 is configured to perform the following processing on the first message on the first interface of the first node: in a case where the first information indicates that the first interface of the first node is enabled to use ARN, performing ARN-related forwarding processing on the first message on the first interface; or in a case where the first information indicates that the first interface of the first node is disabled to use ARN, performing non-ARN-related forwarding processing on the first message on the first interface.

[0184] In an embodiment, the first message further comprises second information, the second information indicating a source of the first message; and the processing unit 802 is specifically configured to:

[0185] In a case where the first information indicates that the first interface of the first node is enabled to use ARN, the processing unit 802 is configured to: check the second information and the first ARN identifier; and in a case where the check is successful, perform ARN-related forwarding processing on the first message on the first interface.

[0186] In an embodiment, the first message further comprises second information, the second information indicating a source of the first message; and the processing unit 802 is specifically configured to:

[0187] In a case where the first information indicates that the first interface of the first node is enabled to use ARN, the processing unit 802 is configured to: check the second information and the first ARN identifier; and in a case where the check is unsuccessful, perform non-ARN-related forwarding processing on the first message on the first interface.

[0188] In an embodiment, the processing unit 802 is specifically configured to:

[0189] The processing unit 802 is configured to check the second information and the first ARN identifier by using third information, the third information indicating a correspondence between source information of one or more messages and an ARN identifier.

[0190] In an embodiment, the receiving unit 801 is further configured to receive the third information sent by a control device.

[0191] Alternatively,

[0192] The processing unit 802 is further configured to determine the third information by route learning.

[0193] In an embodiment, the processing unit 802 is specifically configured to perform one of the following:

[0194] The processing unit 802 is configured to perform the following processing on the first message on the first interface of the first node: in a case where the first information indicates that the first interface of the first node is enabled to use ARN, performing ARN-related forwarding processing on the first message on the first interface; or in a case where the first information indicates that the first interface of the first node is disabled to use ARN, performing non-ARN-related forwarding processing on the first message on the first interface.

[0195] set a first field carrying the first ARN identifier in the first packet to a third ARN identifier, to obtain a processed first packet, the third ARN identifier being associated with the first network, and forwarding the processed first packet in the first network according to a first manner, the first manner being associated with the third ARN identifier;

[0196] forward the first packet to the second network, the second network being capable of forwarding packets according to a second manner, the second manner being associated with a second ARN identifier corresponding to the first packet;

[0197] forward the first packet in the first network according to a third manner, the third manner being associated with the first ARN identifier.

[0198] In an embodiment, the processing unit 802 is specifically configured to:

[0199] set a first field carrying the first ARN identifier in the first packet to a second ARN identifier or a third ARN identifier by using fourth information, the fourth information representing a corresponding relationship between one or more ARN identifiers associated with the first network and ARN identifiers associated with the second network.

[0200] In an embodiment, the receiving unit 801 is further configured to receive the fourth information sent by a control device.

[0201] Alternatively,

[0202] The processing unit 802 is further configured to determine the fourth information through route learning.

[0203] In an embodiment, the processing unit 802 is specifically configured to perform one of the following:

[0204] set a first field carrying the first ARN identifier in the first packet to fifth information, to obtain a processed first packet, and forward the processed first packet in the first network according to a fourth manner, the fourth manner not being associated with ARN, the fifth information representing that the first packet disables ARN;

[0205] set a first field carrying the first ARN identifier in the first packet to fifth information, to obtain a processed first packet, and forward the processed first packet to a second network, the fifth information representing that the first packet disables ARN;

[0206] discard the first packet.

[0207] In actual application, the receiving unit 801 can be implemented by a communication interface in the packet processing device, and the processing unit 802 can be implemented by a processor in the packet processing device.

[0208] It should be noted that, the packet processing device provided in the above embodiments is only used for packet processing by way of example of the above division of the program units, and in actual application, the above processing can be completed by different program units according to needs, that is, the internal structure of the device is divided into different program units to complete all or part of the above processing. In addition, the packet processing device and the packet processing method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be repeated here.

[0209] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of the present application, the embodiments of the present application also provide a node, as shown in the following table: Figure 9 The node 900 includes:

[0210] The communication interface 901 can interact with other devices (such as control devices, etc.) to exchange information.

[0211] The processor 902 is connected with the communication interface 901 to realize information interaction with other devices, and is used to run a computer program to execute the method provided in one or more of the above technical solutions.

[0212] The computer program is stored in the memory 903.

[0213] Specifically, the communication interface 901 is configured to:

[0214] receive a first packet, wherein the first packet contains a first ARN identifier;

[0215] The processor 902 is configured to:

[0216] if the first information indicates that the first interface of the node can use ARN, perform ARN-associated forwarding-related processing on the first packet at the first interface, or if the first information indicates that the first interface of the node disables ARN, perform non-ARN-associated forwarding-related processing on the first packet at the first interface.

[0217] In an embodiment, the first packet further contains second information, and the second information represents the source of the first packet; and the processor 902 is specifically configured to:

[0218] In a case where the first information indicates that the first interface of the node can use the ARN, the second information is checked against the first ARN identifier; and in a case where the checking succeeds, the first message is subjected to the forwarding-related processing associated with the ARN at the first interface.

[0219] In an embodiment, the first message further comprises second information indicating a source of the first message; and the processor 902 is specifically configured to:

[0220] In a case where the first information indicates that the first interface of the node can use the ARN, the second information is checked against the first ARN identifier; and in a case where the checking fails, the first message is subjected to the forwarding-related processing not associated with the ARN at the first interface.

[0221] In an embodiment, the processor 902 is specifically configured to:

[0222] The third information is used to check the second information against the first ARN identifier, the third information indicating a correspondence between source information of one or more messages and the ARN identifier.

[0223] In an embodiment, the communication interface 901 is further configured to receive the third information sent by a control device.

[0224] Alternatively,

[0225] The processor 902 is further configured to determine the third information through route learning.

[0226] In an embodiment, the processor 902 is specifically configured to perform one of the following:

[0227] A first field in the first message carrying the first ARN identifier is set to a second ARN identifier, to obtain a processed first message, the second ARN identifier being associated with a second network, and the processed first message is forwarded to the second network;

[0228] A first field in the first message carrying the first ARN identifier is set to a third ARN identifier, to obtain a processed first message, the third ARN identifier being associated with a first network, and the processed first message is forwarded in the first network according to a first manner, the first manner being associated with the third ARN identifier;

[0229] The first message is forwarded to the second network, and the second network is capable of forwarding messages according to a second manner, the second manner being associated with a second ARN identifier corresponding to the first message;

[0230] The first message is forwarded in the first network according to a third manner, the third manner being associated with the first ARN identifier.

[0231] In an embodiment, the processor 902 is specifically configured to:

[0232] set a first field carrying the first ARN identifier in the first packet to a second ARN identifier, or set the first field carrying the first ARN identifier in the first packet to a third ARN identifier, by using fourth information, the fourth information representing a corresponding relationship between an ARN identifier associated with the one or more first networks and an ARN identifier associated with the second network.

[0233] In an embodiment, the communication interface 901 is further configured to receive the fourth information sent by a control device.

[0234] Alternatively,

[0235] The processor 902 is further configured to determine the fourth information through route learning.

[0236] In an embodiment, the processor 902 is specifically configured to perform one of the following:

[0237] set a first field carrying the first ARN identifier in the first packet to fifth information to obtain a processed first packet, and forward the processed first packet in the first network according to a fourth manner, the fourth manner being not associated with ARN, the fifth information representing that the first packet disables ARN;

[0238] set a first field carrying the first ARN identifier in the first packet to fifth information to obtain a processed first packet, and forward the processed first packet to the second network, the fifth information representing that the first packet disables ARN;

[0239] discard the first packet.

[0240] It should be noted that the specific processing process of the processor 902 and the communication interface 901 can be understood with reference to the above method.

[0241] Of course, in actual application, each component in the node 900 is coupled together through the bus system 904. It can be understood that the bus system 904 is used to realize the connection and communication between the components. In addition to including a data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 904 in the Figure 9 .

[0242] The memory 903 in the embodiment of the application is used to store various types of data to support the operation of the node 900. Examples of these data include: any computer program used for operation on the node 900.

[0243] The method disclosed in the embodiments of the present application can be applied to the processor 902 or implemented by the processor 902. The processor 902 can be an integrated circuit chip having a signal processing capability. In the implementation process, each step of the above method can be completed by an integrated logic circuit or an instruction in a software form of the processor 902. The processor 902 disclosed above can be a general processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor 902 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly implemented or executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 903, and the processor 902 reads the information in the memory 903 to complete the steps of the above method in combination with the hardware.

[0244] In the exemplary embodiments, the node 900 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, micro controllers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the above method.

[0245] It can be understood that the memory (the memory 903) of the embodiments of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM, Read Only Memory), a programmable read-only memory (PROM, Programmable Read-Only Memory), an erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory), an electrically erasable programmable read-only memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), a ferromagnetic random access memory (FRAM, ferromagnetic random access memory), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM, Compact Disc Read-Only Memory); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM, Random Access Memory) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as static random access memory (SRAM, Static Random Access Memory), synchronous static random access memory (SSRAM, Synchronous Static Random Access Memory), dynamic random access memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDR SDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced synchronous dynamic random access memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), direct memory bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0246] In the example embodiments, the embodiments of the present application also provide a storage medium, specifically a computer readable storage medium, such as a memory 903 storing a computer program executable by the processor 902 of the node 900 to complete the steps of the foregoing method. The computer readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0247] In the example embodiments, the embodiments of the present application also provide a computer program product comprising a computer program executable by the processor 902 of the node 900 to complete the steps of the foregoing method.

[0248] It should be noted that "first", "second", etc. are used to distinguish similar objects, and do not necessarily mean a specific order or sequence.

[0249] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0250] The above is only a preferred embodiment of the present application, and is not intended to limit the protection scope of the present application.

Claims

1. A method of processing a packet, the method comprising: Comprising: A first node receives a first packet, the first packet containing a first application response network identifier, the first node being a border node of a first network; In a case where first information indicates that an application response network is available for a first interface of the first node, the first node performs a first forwarding-related processing associated with the application response network on the first packet at the first interface, or, in a case where the first information indicates that the application response network is disabled for the first interface of the first node, the first node performs a second forwarding-related processing not associated with the application response network on the first packet at the first interface; wherein The first packet further contains second information indicating a source of the first packet; in a case where the first information indicates that the application response network is available for the first interface of the first node, the first node checks the second information and the first application response network identifier; after a successful check, the first node performs the first forwarding-related processing associated with the application response network on the first packet at the first interface, or, after a failed check, the first node performs the second forwarding-related processing not associated with the application response network on the first packet at the first interface.

2. The method of claim 1, wherein, The checking the second information and the first application response network identifier comprises: The first node checks the second information and the first application response network identifier by using third information, the third information indicating a correspondence between source information of one or more packets and application response network identifiers.

3. The method of claim 2, wherein, The method further comprises: The first node receives the third information sent by a control device; Or, The first node determines the third information through route learning.

4. The method of claim 1, wherein, The second information comprises one or more of: User information of the first packet; Source address information of the first packet; Port information of the first packet.

5. The method of claim 1, wherein, The first forwarding-related processing associated with the application response network comprises one of: The first node sets a first field in the first packet carrying the first application response network identifier to a second application response network identifier, obtains a processed first packet, the second application response network identifier being associated with a second network, and forwards the processed first packet to the second network; The first node sets a first field in the first packet carrying the first application response network identifier to a third application response network identifier, obtains a processed first packet, the third application response network identifier being associated with the first network, and forwards the processed first packet in the first network according to a first manner, the first manner being associated with the third application response network identifier; The first node forwards the first packet to the second network, the second network being capable of forwarding packets according to a second manner, the second manner being associated with a second application response network identifier corresponding to the first packet; The first node forwards the first packet in the first network according to a third manner, the third manner being associated with the first application response network identifier.

6. The method of claim 5, wherein The first node sets a first field carrying the first application response network identifier in the first message to a second application response network identifier or sets the first field carrying the first application response network identifier in the first message to a third application response network identifier by using fourth information, where the fourth information represents a corresponding relationship between one or more first network-associated application response network identifiers and a second network-associated application response network identifier.

7. The method of claim 6, wherein, The method further includes: The first node receives the fourth information sent by a control device; Or, The first node determines the fourth information through route learning.

8. The method of claim 1, wherein, The processing of the first message that is not related to application response network-associated forwarding includes one of the following: The first node sets a first field carrying the first application response network identifier in the first message to fifth information to obtain a processed first message, and forwards the processed first message in a fourth manner in the first network, where the fourth manner is not associated with an application response network, and the fifth information represents that the first message disables an application response network; The first node sets a first field carrying the first application response network identifier in the first message to fifth information to obtain a processed first message, and forwards the processed first message to a second network, where the fifth information represents that the first message disables an application response network; The first node discards the first message.

9. A packet processing device, characterized by, The first node is a border node of a first network, and includes: A receiving unit configured to receive a first message, where the first message includes a first application response network identifier; A processing unit configured to, in a case where first information indicates that a first interface of the first node can use an application response network, perform application response network-associated forwarding-related processing on the first message at the first interface, or in a case where the first information indicates that the first interface of the first node disables the application response network, perform processing on the first message at the first interface that is not related to the application response network-associated forwarding; where the first message further includes second information, and the second information represents a source of the first message. The processing unit is specifically configured to: In a case where the first information indicates that the first interface of the first node can use an application response network, check the second information and a first application response network identifier; after successful checking, the processing unit is configured to perform application response network-associated forwarding-related processing on the first message at the first interface, or after failed checking, perform processing on the first message at the first interface that is not related to the application response network-associated forwarding.

10. A node, characterized by The node is a border node of a first network, and includes: A communication interface configured to receive a first message, where the first message includes a first application response network identifier; The processor is configured to perform, on the first interface, forwarding-related processing associated with the application response network on the first interface if the first information indicates that the application response network is available for the first interface, or perform forwarding-related processing not associated with the application response network on the first interface if the first information indicates that the application response network is disabled for the first interface; wherein the first packet further comprises second information indicating a source of the first packet. The processor is specifically configured to: check the second information and a first ARN identifier if the first information indicates that the application response network is available for the first interface; and perform, on the first interface, forwarding-related processing associated with the application response network after a successful check, or perform forwarding-related processing not associated with the application response network after a failed check.

11. A node, characterized by comprise: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 8.

12. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the steps of the method according to any one of claims 1 to 8.

13. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1 to 8.

Images