Communication method and apparatus

Abstract

The application provides a communication method and device, the method is applied to a first node, the first node is on an SRv6 forwarding path, and the method comprises the following steps: receiving a first SRv6 packet sent by a second node, wherein the first SRv6 packet comprises a first source IP address and first check information, the first check information comprises a first key ID and a first digest; performing encryption calculation on the first source IP address through a first encryption algorithm corresponding to the first key ID to obtain a second digest; and if the second digest is the same as the first digest, performing forwarding processing on the first SRv6 packet.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a communication method and device. BACKGROUND

[0002] At present, as a new type of carrying protocol, Segment Routing IPv6 (SRv6) based on an IPv6 forwarding plane can meet network and service flexible arrangement and has good application prospects, and has attracted widespread attention from the industry.

[0003] SRv6 technology redefines a Segment Routing Header (SRH) encapsulating Segement ID (SID) related information based on an IPv6 packet header.

[0004] In the IETF document, it is specified that an SR network needs to have a clear network edge, and a clear network trusted domain is determined, and network devices in the trusted domain are identified as safe. In order to improve the security guarantee of the SRv6 packet and reduce the risk of leaking the SID to the external domain, and also to prevent the SID list indicating the SRv6 packet forwarding path encapsulated in the SRH from being maliciously tampered with, it is necessary to add a security verification mechanism to the SRv6 packet. The SRH is verified for legality to ensure that the SRv6 packet comes from a trusted data source and the packet header has not been illegally tampered with by an intermediate device.

[0005] In the IETF document, a Hash-based Message Authentication Code (HMAC) TLV is defined for the SRH. Through the HMAC information carried in the SRH, most unsafe SRv6 packets in the scene can be filtered out. However, defining the HMAC TLV in the SRH also exposes the following problems: 1) for SRv6 packets that are compressed by the SRv6 header without encapsulating the SRH, the downstream SRv6 node cannot perform security verification; 2) the HMAC TLV encapsulated in the SRH needs to be parsed at each SRv6 node, which affects the forwarding performance of the intermediate node. SUMMARY

[0006] Therefore, the present application provides a communication method and device to solve the problems of the existing SRH carrying the HMAC information, that is, the downstream SRv6 node cannot perform security verification and the intermediate node forwarding performance is affected.

[0007] In a first aspect, a communication method is provided. The method is applied to a first node on an SRv6 forwarding path. The method comprises:

[0008] receiving a first SRv6 packet sent by a second node, the first SRv6 packet comprising a first source IP address and first verification information, the first verification information comprising a first key ID and a first digest;

[0009] performing encryption calculation on the first source IP address by a first encryption algorithm corresponding to the first key ID to obtain a second digest;

[0010] if the second digest is the same as the first digest, performing forwarding processing on the first SRv6 packet.

[0011] In a second aspect, a communication apparatus is provided. The apparatus is applied to a first node on an SRv6 forwarding path. The apparatus comprises:

[0012] a receiving unit, configured to receive a first SRv6 packet sent by a second node, the first SRv6 packet comprising a first source IP address and first verification information, the first verification information comprising a first key ID and a first digest;

[0013] an encryption unit, configured to perform encryption calculation on the first source IP address by a first encryption algorithm corresponding to the first key ID to obtain a second digest;

[0014] a sending unit, configured to, if the second digest is the same as the first digest, perform forwarding processing on the first SRv6 packet.

[0015] In a third aspect, a network device is provided. The network device comprises a processor and a machine readable storage medium. The machine readable storage medium stores machine executable instructions which can be executed by the processor. The processor is prompted by the machine executable instructions to execute the method provided in the first aspect.

[0016] Therefore, by applying the communication method and apparatus provided in the present application, the first node receives a first SRv6 packet sent by a second node. The first SRv6 packet comprises a first source IP address and first verification information. The first verification information comprises a first key ID and a first digest. The first node performs encryption calculation on the first source IP address by a first encryption algorithm corresponding to the first key ID to obtain a second digest. If the second digest is the same as the first digest, the first node performs forwarding processing on the first SRv6 packet.

[0017] In this way, whether the SRH exists in the SRv6 packet or not, the security check processing of the SRv6 packet can also be implemented. By adjusting the encapsulation position between the DOH and the SRH, whether the intermediate node performs the security check processing can be flexibly controlled. At the same time, no special configuration is needed on the intermediate node, which simplifies the network deployment and improves the forwarding performance of the intermediate node in the scenario where only the tail node performs the security check processing. The problems of the existing SRH carrying the HMAC information, the downstream SRv6 node being unable to perform the security check, and the influence on the forwarding performance of the intermediate node are solved. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 Flowchart of a communication method provided by an embodiment of the present application;

[0019] Figure 2 DOH structure diagram provided by an embodiment of the present application;

[0020] Figure 3 Structure diagram of an option field in the DOH provided by an embodiment of the present application;

[0021] Figure 4 SRv6 security check option structure diagram provided by an embodiment of the present application;

[0022] Figure 5 Structure diagram of a communication device provided by an embodiment of the present application;

[0023] Figure 6 Network equipment hardware structure provided by an embodiment of the present application. DETAILED DESCRIPTION

[0024] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same or similar components. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0025] The terms used in the present application are merely for the purpose of describing particular embodiments and are not intended to limit the present application. As used in the present application and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "and / or," as used herein, refer to and encompass any or all possible combinations of one or more of the associated listed items.

[0026] It should be understood that, although the terms first, second, third, etc. can be employed in this application to describe various information, the information should not be limited to these terms. These terms are only used to differentiate one piece of information from another piece of information. For example, without departing from the scope of the application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if' as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0027] The communication method provided by the embodiments of the application is described in detail below. Referring to Figure 1 , Figure 1 The flowchart of the communication method provided by the embodiments of the application is shown. The method is applied to a first node. The communication method provided by the embodiments of the application can include the following steps.

[0028] Step 110, receiving a first SRv6 packet sent by a second node, the first SRv6 packet including a first source IP address and first verification information, the first verification information including a first key ID and a first digest;

[0029] Specifically, in the SRv6 network, a plurality of SRv6 nodes form an SRv6 forwarding path for forwarding service SRv6 packets. On the SRv6 forwarding path, there are a head node, at least one intermediate node, and a tail node.

[0030] The first node on the SRv6 forwarding path is taken as an example for illustration.

[0031] In this step, the first node can be specifically an intermediate node or a tail node, and the second node is a head node. The second node generates a first SRv6 packet, which includes a first source IP address and first verification information, and the first verification information includes a first key ID and a first digest.

[0032] Through the SRv6 forwarding path, the second node sends the first SRv6 packet to the first node. After receiving the SRv6 packet, the first node first obtains the destination IP address therefrom. If the destination IP address matches the SID of the first node, the first node continues to obtain the first source IP address and the first verification information therefrom, and obtains the first key ID and the first digest from the first verification information.

[0033] Optionally, in this embodiment, the first SRv6 message includes a first IPv6 basic header and a first DOH. The first IPv6 basic header includes a next header field, and the first DOH includes an SRv6 Security Verification Option, which carries first verification information. Figure 2 As shown, Figure 2 This is a schematic diagram of the DOH structure provided in an embodiment of this application.

[0034] exist Figure 2 In this context, DOH stands for Type Length Value (TLV) structure, which includes a Next Header field, an Extended Header Length (Ext Header Len) field, and an Options field. The Next Header field occupies 1 byte; the Extended Header Length field occupies 1 byte; and the Options field can contain one or more options, with a variable number of bytes. One option in the Options field is used to carry SRv6 security check options.

[0035] like Figure 3 As shown, Figure 3 This is a schematic diagram of the structure of the option field in the DOH provided in the embodiments of this application.

[0036] exist Figure 3 In this context, the option field is also a TLV structure, which includes an option type field, an option data length field, and an option data field. The option type field occupies 1 byte; the option data length field occupies 1 byte; and the option data field has a variable number of bytes and is used to carry SRv6 security verification options.

[0037] like Figure 4 As shown, Figure 4 This is a schematic diagram of the SRv6 security verification option structure provided in an embodiment of this application.

[0038] exist Figure 4 In the SRv6 security verification options, there are Option Type field, Option Data Length field, HMAC Key ID field, and HMAC Digest field. The HMAC Key ID field is used to store the first key ID, and the HMAC Digest field is used to store the first digest.

[0039] The option type field occupies 1 byte, the value is uniformly allocated by IANA, the option data length field occupies 1 byte, the HMAC key ID field occupies 2 bytes, is the identification of the shared key pre-uniformly deployed in the SRv6 node, different shared keys with different IDs can use different key algorithms, for example, the key numbered 10 uses MD5 algorithm to calculate the digest, and the key numbered 11 uses SHA-1 algorithm to calculate the digest, and the HMAC digest field occupies 32 bytes, which is generated by encrypting and calculating the content of the SRv6 packet header according to the shared key indicated by the HMAC key ID.

[0040] Further, in this step, when the first node is an intermediate node or a tail node, the first node obtains the first source IP address from the first IPv6 basic header, and identifies the value of the next header field.

[0041] When the value of the next header field is 60, the first node determines that the next packet header is the first DOH, at this time, the first node parses the first DOH and obtains the SRv6 security verification option from the first DOH. The first node continues to obtain the first key ID and the first digest from the SRv6 security verification option.

[0042] Step 120, encrypting and calculating the first source IP address through the first encryption algorithm corresponding to the first key ID to obtain a second digest.

[0043] Specifically, according to the description of step 110, after the first node obtains the first key ID and the first digest, the first key ID is used to determine the first encryption algorithm corresponding to the first key ID locally.

[0044] The first source IP address is hashed and encrypted by using the first encryption algorithm to obtain the second digest. The second digest is a binary character.

[0045] Optionally, the specific process of encrypting and calculating the first source IP address through the first encryption algorithm corresponding to the first key ID to obtain the second digest is as follows: if the first node is an intermediate node on the SRv6 forwarding path and the first SRv6 packet does not include the first SRH, the first node hashes and encrypts the first source IP address by using the first encryption algorithm to obtain the second digest.

[0046] If the first node is a tail node on the SRv6 forwarding path and the first SRv6 packet does not include the first SRH, the first node hashes and encrypts the first source IP address by using the first encryption algorithm to obtain the second digest.

[0047] It can be understood that the first node performs the hash encryption calculation on the source IP address by the first encryption algorithm to obtain the second digest, which can refer to the existing hash encryption calculation process, and will not be repeated here.

[0048] Step 130, if the second digest is the same as the first digest, the first SRv6 packet is forwarded.

[0049] Specifically, according to the description of steps 110 and 120, after the first node obtains the first digest and the second digest, it compares whether the second digest is the same as the first digest.

[0050] In one implementation, if the second digest is the same as the first digest, the first node determines that the first SRv6 packet is safe and reliable, and continues to forward the first SRv6 packet according to the existing SRv6 protocol.

[0051] If the first node is an intermediate node, the first node continues to forward to the next hop; if the first node is a tail node, the first node strips the first IPv6 basic header and the first DOH, and forwards the inner packet to the next hop.

[0052] In another implementation, if the second digest is different from the first digest, the first node determines that the first SRv6 packet may come from an unsafe data source or has been tampered with. The first node discards the first SRv6 packet.

[0053] The first digest is also a segment of binary characters.

[0054] Therefore, by applying the communication method provided in the present application, the first node receives the first SRv6 packet sent by the second node, which includes the first source IP address and the first verification information, and the first verification information includes the first key ID and the first digest; the first node performs encryption calculation on the first source IP address by the first encryption algorithm corresponding to the first key ID to obtain the second digest; if the second digest is the same as the first digest, the first node forwards the first SRv6 packet.

[0055] In this way, whether the SRv6 packet contains SRH or not, the security verification processing of the SRv6 packet can also be realized. By adjusting the encapsulation position between the DOH and the SRH, it can be flexibly controlled whether the intermediate node performs security verification processing. At the same time, no special configuration is needed on the intermediate node, which not only simplifies the network deployment, but also improves the forwarding performance of the intermediate node in the scenario where only the tail node performs security verification processing. The problem of the existing SRH carrying HMAC information that the downstream SRv6 node cannot perform security verification and affects the forwarding performance of the intermediate node is solved.

[0056] Optionally, in the embodiment of the present application, when the second node generates the first SRv6 packet, if the number of nodes included in the SRv6 forwarding path is large, the second node further generates a first SRH. In this way, the first SRv6 packet further includes the first SRH. When the first SRv6 packet includes the first SRH, the first node further performs the following steps in the security check process of the first SRv6 packet.

[0057] Specifically, after the first node obtains the first key ID and the first digest, the first node determines the first encryption algorithm corresponding to the first key ID locally through the first key ID.

[0058] The first source IP address and the first SRH are encrypted and calculated by using the first encryption algorithm to obtain a third digest. It can be understood that the process of obtaining the third digest by encrypting and calculating the first source IP address and the first SRH by using the first encryption algorithm can refer to the existing encryption calculation process, which is not repeated here.

[0059] When the first SRH participates in the encryption calculation, the segment list (Segment List) included in the first SRH is encrypted and calculated with the first source IP address. In actual calculation, other fields included in the first SRH that do not change (such as the route type field, the flag field, etc.) can also be encrypted and calculated together with the segment list and the first source IP address. The Segment Left (SL) field included in the first SRH is a field whose value changes.

[0060] After the first node obtains the third digest and the second digest, the first node compares whether the third digest is the same as the first digest.

[0061] In one implementation manner, if the third digest is the same as the first digest, the first node determines that the first SRv6 packet is safe and reliable, and continues to perform the forwarding processing on the first SRv6 packet according to the existing SRv6 protocol.

[0062] If the first node is an intermediate node, the first node continues to forward to the next hop; if the first node is a tail node, the first node strips the first IPv6 basic header and the first DOH, and forwards the inner packet to the next hop.

[0063] In another implementation manner, if the third digest is different from the first digest, the first node determines that the first SRv6 packet may come from an unsafe data source or has been tampered. The first node discards the first SRv6 packet.

[0064] The third digest is also a segment of binary characters.

[0065] It should be noted that when the first SRv6 message includes the first SRH, the first node performs different processes according to different positions of the first SRH and the first DOH, and different roles of the first node in the SRv6 forwarding path.

[0066] In an implementation manner, the first node is an intermediate node, and in the first SRv6 message, if the first DOH is before the first SRH, the first node performs security verification on the first SRv6 message according to the first DOH; if the first DOH is after the first SRH, the first node no longer parses the first DOH, that is, no longer performs security verification on the first SRv6 message.

[0067] In another implementation manner, the first node is a tail node, and in the first SRv6 message, no matter the position between the first DOH and the first SRH, the tail node parses each message header, that is, the tail node performs security verification on the first SRv6.

[0068] It can be understood that no matter as an intermediate node or a tail node, after receiving the first SRv6 message, the first node first obtains the destination IP address from the first SRv6 message. If the destination IP address matches the SID of the first node, the first node continues to obtain the first source IP address and identify the next header field.

[0069] The above two cases are described in subsequent embodiments and will not be repeated here.

[0070] Optionally, in the embodiment of the present application, when the value of the nextheader field included in the first IPv6 basic header is 60, the next message header adjacent to the first IPv6 basic header is the first DOH; when the value of the nextheader field included in the first IPv6 basic header is 43, the next message header adjacent to the first IPv6 basic header is the first SRH.

[0071] Optionally, in the embodiment of the present application, when the first SRv6 message includes the first SRH, the first DOH is before or after the first SRH. It can be understood that when the first SRv6 does not include the first SRH, the first DOH is after the IPv6 basic header.

[0072] It should be noted that in the embodiment of the present application, the first SRv6 message can include the first SRH or not include the first SRH, that is, after the first node determines that the next message header adjacent to the IPv6 basic header is the first DOH, the first node obtains the SRv6 security verification option from the first DOH.

[0073] Optionally, in the embodiment of the present application, when the value of the nextheader field included in the first IPv6 basic header is 43, the first node determines that the next message header is the first SRH. The first node continues to identify the value of the nextheader field included in the first SRH.

[0074] When the value of the nextheader field included in the first SRH is 60, the first node determines that the next message header is the first DOH, at this time, the first node no longer parses the first DOH, that is, the first node no longer obtains the SRv6 security check option from the first DOH, and no longer performs security check on the first SRv6 message. The first node can perform forwarding processing on the first SRv6 message according to the existing SRv6 protocol.

[0075] It should be noted that in actual application, there can be multiple other extension headers between the first SRH and the first DOH. Regardless of how many other extension headers exist between the first SRH and the first DOH or between the first DOH and the first SRH, if the first DOH is before the first SRH, the first node performs security check on the first SRv6 message, and otherwise, does not perform security check.

[0076] Optionally, in the embodiment of the present application, the specific process of the first node performing encryption calculation on the first source IP address and the first SRH by the first encryption algorithm corresponding to the first key ID to obtain the third digest is as follows:

[0077] If the first node is an intermediate node on the SRv6 forwarding path and the first DOH is before the first SRH, the first node performs hash encryption calculation on the first source IP address and the first SRH by the first encryption algorithm to obtain the third digest. Or;

[0078] If the first node is a tail node on the SRv6 forwarding path, the first node performs hash encryption calculation on the source IP address and the first SRH by the first encryption algorithm to obtain the third digest.

[0079] Optionally, in the embodiment of the present application, the process of the first node generating and sending the second SRv6 message after acting as the head node is also included.

[0080] Specifically, when the first node is a head node, according to the locally configured security check policy, the first node first determines the characteristic attribute to be subjected to security check. The characteristic attribute specifically includes a service attribute or an interface attribute. The service attribute specifically refers to a service that needs to be subjected to security check, for example, voice service, video service, general Internet service, etc.; the interface attribute specifically refers to which interface of the first node receives the SRv6 message that needs to be subjected to security check.

[0081] The first node generates a second IPv6 basic header (including a source IP address, a destination IP address, a next message header, a flow label, and the like) according to the existing SRv6 protocol according to the determined characteristic attribute. It can be understood that the second IPv6 basic header is in the second SRv6 message, and the structure thereof is the same as that of the first IPv6 basic header.

[0082] The first node again obtains a second key ID from the security check policy, and determines a corresponding second encryption algorithm according to the second key ID. According to the second encryption algorithm, the first node performs encryption calculation on a second source IP address included in the second IPv6 basic header to obtain a fourth digest.

[0083] The first node generates a second DOH, which also includes an SRv6 security check option including the second key ID and the fourth digest. It can be understood that the second DOH has the same structure as the first DOH, and will not be repeated here.

[0084] The first node generates a second SRv6 message and sends the second SRv6 message to a third node. It can be understood that the second SRv6 message includes a second source IP address and second check information including the second key ID and the fourth digest. The third node is an intermediate node or a tail node on an SRv6 forwarding path.

[0085] Optionally, in the embodiment of the present application, when the first node generates the second SRv6 message, if the number of nodes included in the SRv6 forwarding path is large, the first node also generates a second SRH. At this time, the first node can set the position between the second SRH and the second DOH according to the network environment of the current SRv6 network to realize whether the intermediate node performs security check.

[0086] For example, in a network environment with high requirements for SRv6 network forwarding performance, if it is only desired to perform security check on the second SRv6 message at the tail node, the first node encapsulates the second DOH after the second SRH, at this time, the intermediate node receiving the second SRv6 message does not need to parse the second DOH and does not need to perform security check; if it is desired to perform security check on the second SRv6 message at each node included in the SRv6 forwarding path, the first node encapsulates the second DOH before the second SRH, at this time, the intermediate node receiving the second SRv6 message can parse the second DOH and perform security check.

[0087] Further, the intermediate node or the tail node receiving the second SRv6 message can process the second SRv6 according to the description in the foregoing embodiments, and the process is the same and will not be repeated here.

[0088] Based on the same inventive concept, the embodiments of the present application further provide a communication method corresponding to the communication device. Referring to Figure 5 , Figure 5 The communication device provided by the embodiments of the present application is applied to a first node on an SRv6 forwarding path, and comprises:

[0089] The receiving unit 510 is configured to receive a first SRv6 packet sent by a second node, wherein the first SRv6 packet comprises a first source IP address and first check information, and the first check information comprises a first key ID and a first digest;

[0090] The encryption unit 520 is configured to perform encryption calculation on the first source IP address by using a first encryption algorithm corresponding to the first key ID, to obtain a second digest;

[0091] The sending unit 530 is configured to perform forwarding processing on the first SRv6 packet if the second digest is the same as the first digest.

[0092] Optionally, the first SRv6 packet further comprises a first SRH, and the encryption unit 520 is further configured to perform encryption calculation on the first source IP address and the first SRH by using the first encryption algorithm corresponding to the first key ID, to obtain a third digest;

[0093] The sending unit 530 is further configured to perform forwarding processing on the first SRv6 packet if the third digest is the same as the first digest.

[0094] Optionally, the device further comprises a discarding unit (not shown in the figure), configured to discard the first SRv6 packet if the second digest is different from the first digest; or

[0095] If the third digest is different from the first digest, the first SRv6 packet is discarded.

[0096] Optionally, the device further comprises:

[0097] A generating unit (not shown in the figure) is configured to generate a fourth digest according to a locally configured security check policy when the first node is a head node;

[0098] The sending unit 530 is further configured to send a second SRv6 packet to a third node, wherein the second SRv6 packet comprises a second source IP address and second check information, and the second check information comprises a second key ID used to generate the fourth digest and the fourth digest.

[0099] Optionally, the generating unit (not shown in the figure) is specifically configured to determine, according to the security verification policy, a characteristic attribute to be subjected to security verification;

[0100] In the generation of the second SRv6 packet according to the characteristic attribute, the second key ID and the second encryption algorithm corresponding to the second key ID are determined from the security verification policy;

[0101] If the second SRv6 packet includes a second SRH, the second source IP address and the second SRH are subjected to encryption calculation through the second encryption algorithm to obtain the fourth digest;

[0102] If the second SRv6 packet does not include a second SRH, the second source IP address is subjected to encryption calculation through the second encryption algorithm to obtain the fourth digest.

[0103] Optionally, the SRv6 packet includes a destination option header DOH, and the DOH includes an SRv6 security verification option, which is used to carry verification information.

[0104] The SRv6 security verification option includes an HMAC key ID field and an HMAC digest field, the HMAC key ID field is used to store a key ID, and the HMAC digest field is used to store a digest.

[0105] Optionally, the SRv6 packet further includes an IPv6 basic header, and the IPv6 basic header includes a next header field.

[0106] When the value of the next header field is 60, the next packet header adjacent to the IPv6 basic header is the DOH.

[0107] When the value of the next header field is 43, the next packet header adjacent to the IPv6 basic header is an SRH.

[0108] Optionally, when the SRv6 packet includes the SRH, the DOH is before or after the SRH.

[0109] Optionally, the encryption unit 520 is specifically configured to, if the first node is an intermediate node on an SRv6 forwarding path and the first SRv6 packet does not include the first SRH, perform hash encryption calculation on the first source IP address through the first encryption algorithm to obtain the second digest; or

[0110] If the first node is the tail node on the SRv6 forwarding path and the first SRv6 packet does not include the first SRH, then the first source IP address is hashed and encrypted using the first encryption algorithm to obtain the second digest.

[0111] Optionally, the encryption unit 520 is further configured to, if the first node is an intermediate node on the SRv6 forwarding path and the DOH is before the first SRH, perform hash encryption calculation on the source IP address and the first SRH using the first encryption algorithm to obtain the third digest; or;

[0112] If the first node is the tail node on the SRv6 forwarding path, then the third digest is obtained by hashing and encrypting the source IP address and the first SRH using the first encryption algorithm.

[0113] Optionally, the sending unit 530 is further configured to forward the first SRv6 message if the first node is an intermediate node on the SRv6 forwarding path and the DOH is after the first SRH.

[0114] Therefore, by applying the communication device provided in this application, the first node receives a first SRv6 message sent by the second node. The first SRv6 message includes a first source IP address and first verification information, which includes a first key ID and a first digest. Using the first encryption algorithm corresponding to the first key ID, the first node performs encryption calculation on the first source IP address to obtain a second digest. If the second digest is the same as the first digest, the first node forwards the first SRv6 message.

[0115] Thus, secure verification processing of SRv6 packets can be achieved regardless of whether an SRH is present in the SRv6 packet. By adjusting the encapsulation position between the DOH and SRH, the security verification process performed by intermediate nodes can be flexibly controlled. Furthermore, no special configuration is required on the intermediate nodes, simplifying network deployment and improving the forwarding performance of intermediate nodes in scenarios where only the tail node needs to perform security verification. This solves the problem that downstream SRv6 nodes cannot perform security verification when HMAC information is carried in the existing SRH, and this also affects the forwarding performance of intermediate nodes.

[0116] Based on the same inventive concept, embodiments of this application also provide a network device, such as... Figure 6 As shown, the system includes a processor 610, a transceiver 620, and a machine-readable storage medium 630. The machine-readable storage medium 630 stores machine-executable instructions that can be executed by the processor 610. The processor 610 is prompted by the machine-executable instructions to execute the communication method provided in the embodiments of this application. (The foregoing...) Figure 5The communication device shown can employ, for example Figure 6 The network equipment hardware structure shown is implemented.

[0117] The computer readable storage medium 630 can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer readable storage medium 630 can also be at least one storage device located remotely from the processor 610.

[0118] The processor 610 can be a general processor, including a central processing unit (CPU), a network processor (NP), etc. The processor 610 can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components.

[0119] In the embodiments of the present application, the processor 610 reads the machine executable instructions stored in the machine readable storage medium 630, and the machine executable instructions enable the processor 610 itself and the transceiver 620 to perform the communication method described in the foregoing embodiments of the present application.

[0120] In addition, the embodiments of the present application provide a machine readable storage medium 630, which stores machine executable instructions. When the processor 610 calls and executes the machine executable instructions, the machine executable instructions enable the processor 610 itself and the transceiver 620 to perform the communication method described in the foregoing embodiments of the present application.

[0121] The implementation processes of the functions and roles of the units in the above device are specifically described in the implementation processes of the corresponding steps in the above method, and will not be described here.

[0122] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be seen from the part of the method embodiment. The device embodiment described above is only illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the scheme of the present application according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0123] For the communication device and machine readable storage medium embodiments, since the method content involved is basically similar to the foregoing method embodiment, the description is relatively simple, and the relevant part can be seen from the part of the method embodiment.

[0124] The above is only the preferred embodiment of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A communication method characterized by comprising: The method is applied to a first node on an SRv6 forwarding path, and the method comprises: receiving a first SRv6 packet sent by a second node, wherein the first SRv6 packet comprises a first source IP address and first verification information, and the first verification information comprises a first key ID and a first digest; performing encryption calculation on the first source IP address by using a first encryption algorithm corresponding to the first key ID to obtain a second digest; if the second digest is the same as the first digest, performing forwarding processing on the first SRv6 packet.

2. The method of claim 1, wherein, The first SRv6 packet further comprises a first SRH, and after receiving the first SRv6 packet sent by the second node, the method further comprises: performing encryption calculation on the first source IP address and the first SRH by using the first encryption algorithm corresponding to the first key ID to obtain a third digest; if the third digest is the same as the first digest, performing forwarding processing on the first SRv6 packet.

3. The method of claim 2, wherein, The method further comprises: if the second digest is different from the first digest, discarding the first SRv6 packet; or if the third digest is different from the first digest, discarding the first SRv6 packet.

4. The method of claim 1, wherein, The method further comprises: when the first node is a head node, generating a fourth digest according to a locally configured security verification policy; sending a second SRv6 packet to a third node, wherein the second SRv6 packet comprises a second source IP address and second verification information, and the second verification information comprises a second key ID used for generating the fourth digest and the fourth digest.

5. The method of claim 4, wherein, The generating of the fourth digest according to the locally configured security verification policy specifically comprises: determining a characteristic attribute to be subjected to security verification according to the security verification policy; when generating the second SRv6 packet according to the characteristic attribute, determining the second key ID and a second encryption algorithm corresponding to the second key ID from the security verification policy; if the second SRv6 packet comprises a second SRH, performing encryption calculation on the second source IP address and the second SRH by using the second encryption algorithm to obtain the fourth digest; if the second SRv6 packet does not comprise a second SRH, performing encryption calculation on the second source IP address by using the second encryption algorithm to obtain the fourth digest.

6. The method according to any one of claims 1 to 5, characterized in that, The SRv6 packet comprises a destination option header (DOH), and the DOH comprises an SRv6 security verification option, wherein the SRv6 security verification option is used for carrying verification information. The SRv6 security verification option comprises an HMAC key ID field and an HMAC digest field, wherein the HMAC key ID field is used for storing a key ID, and the HMAC digest field is used for storing a digest.

7. The method of claim 6, wherein, The SRv6 packet further comprises an IPv6 basic header, and the IPv6 basic header comprises a next header field; when the value of the next header field is 60, the next packet header adjacent to the IPv6 basic header is the DOH. When the value of the nextheader field is 43, the next packet header adjacent to the IPv6 basic header is SRH.

8. The method of claim 7, wherein, When the SRv6 packet includes the SRH, the DOH is before or after the SRH.

9. The method of claim 8, wherein, The first source IP address is encrypted by a first encryption algorithm corresponding to the first key ID to obtain a second digest, specifically including: If the first node is an intermediate node on the SRv6 forwarding path and the first SRv6 packet does not include the first SRH, the first source IP address is hashed and encrypted by the first encryption algorithm to obtain the second digest; or If the first node is a tail node on the SRv6 forwarding path and the first SRv6 packet does not include the first SRH, the first source IP address is hashed and encrypted by the first encryption algorithm to obtain the second digest.

10. The method of claim 8, wherein, The first source IP address and the first SRH are encrypted by a first encryption algorithm corresponding to the first key ID to obtain a third digest, specifically including: If the first node is an intermediate node on the SRv6 forwarding path and the DOH is before the first SRH, the source IP address and the first SRH are hashed and encrypted by the first encryption algorithm to obtain the third digest; or If the first node is a tail node on the SRv6 forwarding path, the source IP address and the first SRH are hashed and encrypted by the first encryption algorithm to obtain the third digest.

11. The method of claim 8, wherein, The method further includes: If the first node is an intermediate node on the SRv6 forwarding path and the DOH is after the first SRH, the first SRv6 packet is forwarded.

12. A communications device, characterized by The device is applied to a first node on an SRv6 forwarding path, and includes: A receiving unit is configured to receive a first SRv6 packet sent by a second node, the first SRv6 packet including a first source IP address and first verification information, the first verification information including a first key ID and a first digest; An encryption unit is configured to encrypt the first source IP address by a first encryption algorithm corresponding to the first key ID to obtain a second digest; A sending unit is configured to forward the first SRv6 packet if the second digest is the same as the first digest.

Images