Message propagation method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a message propagation method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of network communication and security. The method comprises the steps that a head end router analyzes a segment routing strategy sent by a controller to obtain a target segment list, the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used for representing nodes in a network, and the target segment list is used for defining a forwarding path; the head end router generates a source address verification message based on the segment routing strategy; and the head end router forwards the source address verification message according to the forwarding path. According to the method, a source address verification message propagation mechanism based on a segment routing strategy is provided, SAV messages are guided by defining a clear path, and it is ensured that the source address verification messages are propagated efficiently, safely and accurately.

Description

Technical Field

[0001] The present disclosure relates to the field of network communication and security technology, and in particular to a message propagation method, a message propagation device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] In modern network environments, the Source Address Validation (SAV) mechanism is essential to ensure that data packets have a legitimate source address. Traditional SAV mechanisms usually rely on routing tables for control and policy generation, but this approach lacks flexibility and fine control. The SAV mechanism of Policy-Based Routing (PBR) provides some improvements, but it still cannot solve the aforementioned SAV mechanism failure problem caused by data packets being forwarded based on Segment Routing Policy (SR-policy). Based on this, it is necessary to propose a SAV message propagation mechanism based on SR-policy.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0004] The embodiments of the present disclosure provide a message propagation method, a message propagation device, an electronic device, a computer-readable storage medium, and a computer program product, which guide SAV messages by defining a clear path to ensure efficient, secure, and accurate propagation of source address verification messages.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0006] According to one aspect of the present disclosure, a message propagation method is provided, the method comprising: a head-end router parses a segment routing policy sent by a controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path; the head-end router generates a source address verification message based on the segment routing policy; the head-end router forwards the source address verification message according to the forwarding path.

[0007] In some embodiments of the present disclosure, the method further includes: the head-end router forwards the source address verification message to other routers according to the forwarding path, so that the other routers create source address verification rules at the receiving interface after receiving the source address verification message.

[0008] In some embodiments of the present disclosure, the source address verification message includes: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; the message type field is used to identify the type of the message; the source router field is used to identify the identifier of the source router; the neighbor router field is used to identify the identifier of the neighbor router; the source prefix field is used to identify the source prefix; and the segment list field is used to identify the segment list defined by the segment routing policy.

[0009] In some embodiments of the present disclosure, the source address verification message also includes one or more of a security level field and a quality of service field; the security level field is used to indicate security requirements; and the quality of service field is used to indicate quality of service requirements.

[0010] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: if the segment routing policy includes a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0011] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: if the segment routing policy does not include a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to a default value according to a local traffic control policy; the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0012] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: the head-end router determines the value of the security level field in the source address verification message according to the security requirements in the segment routing policy; the head-end router determines the value of the quality of service field in the source address verification message according to the quality of service requirements in the segment routing policy.

[0013] In some embodiments of the present disclosure, the source address verification rule includes: a source prefix field and a valid interface list field; the source prefix field is used to identify the source prefix; the valid interface list is used to identify the router interface that can receive data packets from the specified source prefix.

[0014] In some embodiments of the present disclosure, the source address verification rule also includes one or more of a security level field and a quality of service field; the security level field is used to identify a policy for processing data packets that do not comply with the rules; and the quality of service field is used to identify quality of service requirements related to data packet processing.

[0015] In some embodiments of the present disclosure, the segment routing strategy includes an optional segment list, which is used to define an alternative path; the method also includes: if the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path to obtain a new source address verification message; the head-end router propagates the new source address verification message according to the alternative path.

[0016] In some embodiments of the present disclosure, the method also includes: the head-end router identifies a specific node; the specific node includes a load balancing node and a traffic monitoring node; the head-end router inserts the specific node into the target segment list, and adjusts the node order and the number of nodes in the target segment list.

[0017] In some embodiments of the present disclosure, the target segment list includes security nodes and service nodes.

[0018] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the method further includes: the head-end router obtains the multiple forwarding paths, and propagates messages on the multiple forwarding paths in parallel.

[0019] According to another aspect of the present disclosure, a message propagation method is provided, the method comprising: a forwarding router receives a source address verification message, and searches and matches a segment list in the source address verification message with one or more locally configured segment identifiers; the source address verification message is generated based on a segment routing policy, and the one or more locally configured segment identifiers are used to identify the role of the forwarding router in the segment routing network; if there is a match, the forwarding router processes the source address verification message; if there is no match, the forwarding router does not process the source address verification message and floods the source address verification message.

[0020] In some embodiments of the present disclosure, the forwarding router floods the source address verification message, including: if the forwarding router fails to find the next hop node indicated by the neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

[0021] In some embodiments of the present disclosure, the forwarding router processes the source address verification message, including: the forwarding router processes the source address verification message, identifies the interface receiving the source address verification message as a valid interface, creates a source address verification rule, and forwards the source address verification message to the next hop node according to the segment list in the source address verification message.

[0022] In some embodiments of the present disclosure, the method further includes: if there is a match, the forwarding router updates the value of the neighbor node field in the source address verification message to the identifier of the next hop node in the forwarding path defined by the segment routing policy.

[0023] In some embodiments of the present disclosure, the method further includes: if there is a match, the forwarding router updates the segment list in the source address verification message so that the segment identifier of the next hop node becomes the current segment identifier of the segment list.

[0024] According to another aspect of the present disclosure, a message propagation device is provided, the device comprising: a policy parsing unit, configured to parse the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path; a message generating unit, configured to generate a source address verification message based on the segment routing policy; and a forwarding unit, configured to forward the source address verification message according to the forwarding path.

[0025] According to another aspect of the present disclosure, a message propagation device is provided, the device comprising: a matching unit, configured to receive a source address verification message, and search and match the segment list in the source address verification message with one or more locally configured segment lists; the source address verification message is generated based on a segment routing policy, and the one or more locally configured segment lists are used to identify the role of the forwarding router in the segment routing network; a message processing unit, configured to process the source address verification message if there is a match; and a message flooding unit, configured to flood the source address verification message if there is no match.

[0026] According to another aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a storage device configured to store one or more programs, so that when the one or more programs are executed by the one or more processors, the one or more processors implement the message propagation method as described in the above embodiments.

[0027] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the message propagation method as described in the above embodiment is implemented.

[0028] According to yet another aspect of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the message propagation method as described in the above embodiment is implemented.

[0029] The message propagation method provided by the embodiment of the present disclosure provides a source address verification message propagation mechanism based on the segment routing policy. The head-end router parses the segment routing policy issued by the controller to obtain a target segment list, which is composed of ordered segment identifiers and is used to define the forwarding path. The head-end router generates a source address verification message based on the segment routing policy, and propagates the source address verification message according to the forwarding path defined by the target segment list. It can be seen that the method can guide the source address verification message through a clearly defined path, and ensure that the source address verification message is propagated efficiently, safely, and accurately, so that the routers on the forwarding path can create corresponding source address verification rules according to the segment routing policy, and can subsequently guide the routers to perform source address verification of data packets according to the source address verification rules.

[0030] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0032] Figure 1 A schematic diagram showing a network scenario to which an embodiment of the present disclosure is applicable;

[0033] Figure 2 A flow chart of a message propagation method according to an embodiment of the present disclosure is shown;

[0034] Figure 3 A flow chart of a message propagation method according to another embodiment of the present disclosure is shown;

[0035] Figure 4A schematic diagram showing an enterprise network topology applicable to an embodiment of the present disclosure;

[0036] Figure 5 A schematic structural diagram of a message transmission device according to an embodiment of the present disclosure is shown;

[0037] Figure 6 A schematic structural diagram of a message transmission device according to another embodiment of the present disclosure is shown;

[0038] Figure 7 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0039] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0040] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0041] It should be noted that the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present disclosure are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects, and the descriptions of "first" and "second" do not limit the objects to be different.

[0042] Figure 1 A schematic diagram of a network scenario applicable to the embodiment of the present disclosure is shown. Figure 1The network scenario shown includes a source server S1, a destination server D1, a router R11, a router R12, a router R13, a router R14, a router R15, a router R16, and a router R17. Among them, routers R11, routers R12, routers R13, routers R14, routers R15, routers R16, and routers R17 belong to the same network, which may be a segment routing (SR) network. These routers may be router devices, or switches or any other devices with routing functions, and the device may be in the form of a physical device or a virtualized device with routing functions, which is not specifically limited in the present disclosure.

[0043] Those skilled in the art will appreciate that the number of routers in the network scenario may be more or less. For example, the number of the above routers may be dozens or hundreds, or more. The embodiments of the present disclosure do not limit the number and device type of routers.

[0044] See also Figure 1 There are multiple forwarding paths between the source server S1 and the destination server D1. For example, one forwarding path is source server S1->router R11->router R12->router R13->router R15->router R17->destination server D1. Another example is that one forwarding path is source server S1->router R11->router R12->router R14->router R16->router R17->destination server D1.

[0045] Optionally, the network scenario may also include a controller, which may be connected to each router via a wireless network or a wired network, and is used to set corresponding forwarding paths for different data packets. The controller may be at least one of a server, multiple servers, a cloud computing platform, and a virtualization center. When there are multiple controllers, there may be at least two controllers for providing different services, and / or there may be at least two controllers for providing the same service, such as providing the same service in a load balancing manner, which is not specifically limited in the embodiments of the present disclosure.

[0046] Figure 2 A flow chart of a message propagation method according to an embodiment of the present disclosure is shown. Figure 2 The message propagation method provided in the embodiment may be executed by a head-end router, such as Figure 1 Router R11 in . Figure 2 The message propagation method specifically includes the following steps S210 to S230.

[0047] Step S210, the head-end router parses the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path.

[0048] Step S220: The head-end router generates a source address verification message based on the segment routing policy.

[0049] Step S230: The head-end router forwards the source address verification message according to the forwarding path.

[0050] The message transmission method provided by the embodiment of the present disclosure is a SAV message propagation method based on SR-policy, which is a policy-based message delivery method, similar to PBR to a certain extent. SR-policy allows operators to define clear paths, and data packets are delivered along the defined paths. The paths can be specified by a series of segment identifiers (Segment Identifier, SID). Similar to PBR, the paths defined by SR-policy can be defined based on various policies, such as traffic type, source address, destination address, etc.

[0051] For ease of understanding, the following is a SAV message propagation method based on SR-policy. Basic concepts of SR-policy: Segment identifier SID, that is, the identifier of each path segment, used to guide traffic in the network; Segment List, that is, a list of a series of SIDs, which defines the path of traffic from the source server to the destination server; SR-policy, that is, a complete policy, containing one or more Segment Lists, each Segment List represents an alternative path. Propagation of SAV messages: In a network configured with SR-policy, SAV messages are propagated along the path defined by SR-policy, and the routers on each path propagate SAV messages hop by hop along the path according to the Segment List specified by SR-policy.

[0052] In a network where SR-policy is configured, the controller generates and sends SR-policy to nodes that need to perform specific traffic processing or forwarding operations. These nodes are usually key nodes in the network, such as gateways, core routers, or edge routers. In the disclosed embodiment, the controller will send SR-policy directly to the head-end router that has established a neighbor relationship with the controller. After receiving the SR-policy, the head-end router will parse it and extract the segment list and related policies.

[0053] After receiving the SR-policy from the controller, the head-end router will perform a series of parsing operations. First, it will parse and extract the Segment List in the SR-policy, which is an ordered list of SIDs, each SID represents a specific node or service in the network. Then, the head-end router will extract the policy information related to these SIDs, which may include the selection of forwarding paths, QoS (quality of service) parameters, etc. Then, the head-end router obtains the target segment list from the segment list according to the policy information. Among them, SR-policy includes multiple segment lists, and the target segment list is selected by the head-end router from multiple segment lists according to the policy information. The target segment list is composed of ordered segment identifiers. The segment identifiers in the target segment list are used to represent nodes in the network. The target segment list is used to define the forwarding path and pass the traffic from the source server to the destination server according to the defined forwarding path.

[0054] After the headend router implements SR-policy, it can generate SAV messages based on SR-policy and propagate the SAV messages along the forwarding path defined by the target segment list, ensuring that the SAV messages reach all relevant routers along the forwarding path and that these relevant routers create corresponding SAV rules based on the SR-policy. Subsequently, the routers can be guided by the SAV rules on how to handle the source address verification of the actual data packets.

[0055] by Figure 1 The network scenario shown in the figure is used as an example. In this scenario, the SR-policy path for traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17. The segment list of this SR policy path includes the segment identifiers of each router. For each router on the path: SID1 represents R11, SID2 represents R12, SID3 represents R13, SID5 represents R15, and SID7 represents R17. When router R11 (headend router) receives traffic from source prefix 10.1.1.0 / 24, for the destination prefix 10.7.0.0 / 16, it generates a SAV message according to the SR policy. The SAV message includes the source router (R11), the neighbor router (R12), the source prefix (10.1.1.0 / 24), the destination prefix (10.7.0.0 / 16), and the segment list [SID1, SID2, SID3, SID5, SID7]. Router R11 propagates the SAV message according to the segment list to ensure that the SAV message reaches routers R12, R13, R15, and R17. In this way, these routers can create corresponding SAV rules based on the SR-policy, and then verify the source address of the data packet based on the SAV rules.

[0056] In some embodiments of the present disclosure, the message propagation method further includes: the head-end router forwards the source address verification message to other routers according to the forwarding path, so that the other routers create source address verification rules at the receiving interface after receiving the source address verification message.

[0057] As a key node for traffic forwarding and processing, the headend router, after receiving the SR-Policy, not only parses it and extracts the segment list and related policies, but also performs a series of security and verification measures. One important step is to create SAV rules based on the SR-Policy to ensure the accuracy and security of traffic forwarding.

[0058] Other routers refer to routers on the forwarding path. Other routers can also be called key nodes, that is, key nodes for message propagation. After generating a SAV message, the headend router forwards the SAV message to other routers along the forwarding path. In this way, after receiving the SAV message, other routers create SAV rules at the receiving interface, and can subsequently verify the source address of the data packet according to the SAV rules.

[0059] SAV rules are mainly used to verify whether the source address of a data packet is legal and valid. In an SR-Policy environment, a router may encounter data packets from different source addresses, which may contain malicious or misleading information. Therefore, the router needs to verify the source address of the data packet to ensure that the data packet comes from a trusted source and complies with the path regulations in SR-Policy.

[0060] In the disclosed embodiment, after generating a SAV message, the head-end router forwards the SAV message to other routers according to the forwarding path. After receiving the SAV message, the other routers create SAV rules at the receiving interface to verify whether the source address of the data packet is legal and valid according to the SAV rules.

[0061] In some embodiments of the present disclosure, the source address verification message includes: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; the message type field is used to identify the type of the message; the source router field is used to identify the identifier of the source router; the neighbor router field is used to identify the identifier of the neighbor router; the source prefix field is used to identify the source prefix; the segment list field is used to identify the segment list defined by the segment routing policy.

[0062] In some embodiments of the present disclosure, the source address verification message also includes one or more of a security level field and a quality of service field; the security level field is used to indicate security requirements; and the quality of service field is used to indicate quality of service requirements.

[0063] In the embodiment of the present disclosure, the SAV message generated based on the SR-policy includes the following fields:

[0064] Message Type (MT): used to identify the type of message. For example, the message type indicates that the message is a SAV message, so that after receiving the message, the receiving node triggers the corresponding processing logic according to the message type.

[0065] Source Router (SR): an identifier used to identify the source router.

[0066] Neighbor Router (NR): An identifier used to identify a neighbor router.

[0067] Source prefix (SP): used to identify the source prefix, that is, the prefix part of the IP address that requires source address verification.

[0068] Segment list (SID_list): used to identify the segment list defined by SR-policy, which is one of the key fields in the SAV message. It contains a series of ordered SIDs, which define the forwarding path of the SAV message in the network. How to process (such as forwarding) the SAV message is determined based on the information in the segment list.

[0069] Security Level (SEC): An indication of security requirements, i.e., used to indicate the security level or policy to be followed when processing SAV messages, which may include encryption requirements, authentication mechanisms, etc., to ensure the security of messages during transmission.

[0070] Quality of Service (QoS): An indication of the quality of service requirements, which is used to specify the QoS parameters that SAV messages should meet when transmitted in the network, such as bandwidth, delay, jitter, etc., which helps to ensure that SAV messages can be processed and forwarded in a timely manner in accordance with network policies and service quality requirements.

[0071] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: if the segment routing policy includes a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0072] In the disclosed embodiment, the head-end router generates a SAV message according to the SR-policy, and sets the message type (MT), source router (SR), neighbor router (NR), source prefix (SP), segment list (SID_list), security level (SEC) and quality of service (QoS) in the SAV message.

[0073] If SR-policy is<srcIP,other,SID_list> , it means that SR-policy contains a source prefix. In this case, the head-end router directly sets the source prefix (SP) field in the SAV message to srcIP, which is the specific source IP address, and also refers to the IP address where the packet originated. The head-end router sets the value of the segment list (SID_list) field in the SAV message to the target segment list defined in the SR-policy, which is the list of path segments that the packet needs to follow when forwarding in the network.

[0074] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: if the segment routing policy does not include a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to a default value according to the local traffic control policy; the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0075] If SR-policy is <*,other,SID_list>, it means that the source prefix is ​​not included in the SR-policy. In this case, the headend router sets the source prefix (SP) field in the SAV message to the default value, which is determined by the local traffic control policy. The headend router sets the value of the segment list (SID_list) field in the SAV message to the target segment list defined in the SR-policy, which is the list of path segments that the data packet needs to follow when forwarding in the network.

[0076] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: the head-end router determines the value of the security level field in the source address verification message according to the security requirements in the segment routing policy; the head-end router determines the value of the service quality field in the source address verification message according to the service quality requirements in the segment routing policy.

[0077] In the disclosed embodiment, the security level (SEC) in the SAV message is set according to the security requirements defined in the SR-policy, and the quality of service (QoS) is set according to the quality of service requirements defined in the SR-policy.

[0078] In some embodiments of the present disclosure, the source address verification rule includes: a source prefix field and a valid interface list field; the source prefix field is used to identify the source prefix; the valid interface list is used to identify the router interface that can receive data packets from the specified source prefix.

[0079] In some embodiments of the present disclosure, the source address verification rule also includes one or more of a security level field and a quality of service field; the security level field is used to identify a policy for processing data packets that do not comply with the rules; and the quality of service field is used to identify quality of service requirements related to data packet processing.

[0080] SAV rules are rules configured on the router to verify the source address of data packets. They are generated based on the received SAV messages and are used to ensure that the source address of the data packets entering the router is legal. SAV rules are statically configured on the router to instruct the router on how to handle the source address verification of actual data packets. The fields contained in the SAV rules are as follows:

[0081] Source prefix (SP): used to identify the source prefix that needs to be verified.

[0082] Valid interface list: used to identify which interfaces can receive packets from the specified source prefix.

[0083] Security Level (SEC): used to define how to handle packets that do not comply with the rules.

[0084] Quality of Service (QoS): Used to indicate the quality of service requirements associated with packet processing.

[0085] In some embodiments of the present disclosure, the segment routing strategy includes an optional segment list, which is used to define an alternative path; the message propagation method also includes: if the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path and obtains a new source address verification message; the head-end router propagates the new source address verification message according to the alternative path.

[0086] In the embodiment of the present disclosure, the SR-policy includes one or more segment lists, wherein the head-end router parses the SR-policy to obtain the one or more segment lists, determines the target segment list according to the relevant policy, and forwards the message according to the forwarding path defined by the target segment list. Among them, the segment list other than the target segment list can be defined as an optional segment list, and the optional segment list is used to define an alternative path.

[0087] If the forwarding path defined by SR-policy (which can be called the main path, i.e. the path defined by the target segment list) is interrupted or an unreachable node appears, the headend router can readjust the segment list according to the alternative path, update the SAV message according to the adjusted segment list, obtain a new SAV message, and then forward the new SAV message according to the alternative path. Also, during the message forwarding process, ensure that the security (SEC) and quality of service (QoS) requirements defined in SR-policy are met, such as priority processing or transmission through a secure node.

[0088] In some embodiments of the present disclosure, the message propagation method also includes: the head-end router identifies specific nodes, the specific nodes include load balancing nodes and traffic monitoring nodes; the head-end router inserts the specific nodes into the target segment list, and adjusts the node order and node quantity in the target segment list.

[0089] The head-end router dynamically identifies and inserts specific nodes on the path, such as load balancing nodes and traffic monitoring nodes, to further optimize message transmission. The head-end router inserts specific nodes into the target segment list based on real-time network analysis results and dynamically adjusts the node order and number of nodes in the target segment list.

[0090] In some embodiments of the present disclosure, the target segment list includes security nodes and service nodes.

[0091] In the disclosed embodiment, specific security nodes and service nodes can be introduced into the target segment list to ensure that the propagation of SAV messages meets the security and service quality requirements. Among them, the security node refers to a node that has been authenticated and protected, which is used to protect the transmission security of the message and prevent malicious attacks; the service node refers to a node with specific QoS guarantee capabilities, which ensures that the message is given priority during the transmission process and meets the service quality requirements.

[0092] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the message propagation method further includes: the head-end router obtains the multiple forwarding paths, and propagates the message in parallel on the multiple forwarding paths.

[0093] Defining multiple optional paths in the target segment list allows messages to be transmitted in parallel on multiple paths to increase reliability and transmission efficiency. Specifically, the optimal path or distributed path can be selected for message transmission based on the network status, and messages that share the same source prefix and point to the same destination address can be merged before sending to reduce communication overhead.

[0094] Figure 3 A flowchart of a message propagation method according to yet another embodiment of the present disclosure is shown. Figure 3 The message propagation method provided in the embodiment may be executed by a forwarding router. The forwarding router refers to a router other than a head-end router in the network, for example Figure 1 Router R12 in . Figure 3 The message propagation method specifically includes the following steps S310 to S330.

[0095] Step S310, the forwarding router receives the source address verification message, and searches and matches the segment list in the source address verification message with one or more locally configured segment identifiers; the source address verification message is generated based on the segment routing policy, and the locally configured one or more segment identifiers are used to identify the role of the forwarding router in the segment routing network.

[0096] Step S320: If there is a match, the forwarding router processes the source address verification message.

[0097] Step S330: If there is no match, the forwarding router does not process the source address verification message and floods the source address verification message.

[0098] After receiving the SAV message, the forwarding router determines whether it is a key node for message propagation. Specifically, after receiving the SAV message, the forwarding router searches for a match in one or more locally configured segment identifiers through the segment list in the SAV message. If the current segment identifier in the segment list in the SAV message exists in the one or more locally configured segment identifiers, a match is confirmed, indicating that the forwarding router is on the forwarding path and should process the SAV message. If a mismatch is confirmed, the forwarding router will not process the SAV message and will flood the SAV message.

[0099] In some embodiments of the present disclosure, the forwarding router floods the source address verification message, including: if the forwarding router fails to find the next hop node indicated by the neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

[0100] If there is no match, it means that the forwarding router is not a critical node, and the forwarding router forwards the SAV message to the node indicated by the neighbor router field (NR) in the SAV message. The neighbor router field (NR) is used to identify the identifier of the neighbor router. In the embodiment of the present disclosure, the neighbor router field (NR) can be used to indicate the next hop node that should receive the SAV message. For example, after a forwarding router receives the SAV message, it updates the neighbor router field (NR) in the SAV message and sets it as the next hop node that should receive the SAV message, that is, the next critical node.

[0101] If the forwarding router is not a key node and the forwarding router does not find the node indicated by the neighbor router field (NR) in the SAV message, the forwarding router uses a flooding mechanism to send the received SAV information to all adjacent routers.

[0102] In addition, if the forwarding router is not a key node, the forwarding router does not need to add a SAV rule based on the SR-Policy on the receiving interface, which can maintain the simplicity and security of the interface policy.

[0103] In some embodiments of the present disclosure, a forwarding router processes a source address verification message, including: the forwarding router processes the source address verification message, identifies the interface receiving the source address verification message as a valid interface, creates a source address verification rule, and forwards the source address verification message to a next-hop node according to a segment list in the source address verification message.

[0104] If there is a match, it means that the forwarding router is a key node. The forwarding router processes the SAV message, identifies the interface receiving the SAV message as a valid interface, and creates a SAV rule.

[0105] In the disclosed embodiment, the next hop node refers to the next key node. After the SAV message is propagated to the forwarding router, if the forwarding router is a key node, it means that the forwarding router is located on the forwarding path, that is, the segment identifier of the forwarding router is in the segment list in the SAV message, and a segment identifier after the segment identifier of the forwarding router in the segment list is the segment identifier of the next hop node. The forwarding router can forward the SAV message to the next hop node according to the segment list in the SAV message.

[0106] If the next hop node is an adjacent node of the forwarding router, the forwarding router forwards the SAV message to the next hop node; if the adjacent nodes of the forwarding router do not include the next hop node, it can be further determined to which node the SAV message is forwarded.

[0107] by Figure 1 The network scenario shown in the figure is used as an example. In this scenario, the SR-policy path for traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17. Router R11 propagates the SAV message according to the segment list, propagates the SAV message to router R12, and specifies that its interface to R12 is valid for traffic incoming from 10.1.1.0 / 24. Router R12 determines that it is the key node for message propagation, determines that its neighboring nodes include R13 and R14, and determines that the next hop node is R13 based on the segment list in the SAV message. Therefore, router R12 determines to forward the SAV message to router R13.

[0108] In some embodiments of the present disclosure, the message propagation method further includes: if there is a match, the forwarding router updates the value of the neighbor node field in the source address verification message to the identifier of the next hop node in the forwarding path defined by the segment routing policy.

[0109] In some embodiments of the present disclosure, the message propagation method further includes: if there is a match, the forwarding router updates the segment list in the source address verification message so that the segment identifier of the next hop node becomes the current segment identifier of the segment list.

[0110] Each time traffic passes through a node that matches the segment list in the SAV message, that is, when the forwarding router receiving the SAV message is a critical node, the current segment identifier in the SAV message will be "consumed" (deleted or skipped from the segment list), and the forwarding router will update the segment list in the SAV message so that the segment identifier of the next-hop node becomes the current segment identifier. The forwarding router will also update the value of the neighbor router field (NR) in the SAV message to the segment identifier of the next-hop node, so that the neighbor router field (NR) indicates the next-hop node. In this way, it can be ensured that the SAV message is propagated along the forwarding path defined by the SR-Policy.

[0111] by Figure 1 The network scenario shown is used as an example. In this scenario, the SR-policy path for traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17. Router R11 propagates the SAV message according to the segment list, propagates the SAV message to router R12, and designates its interface to R12 as valid for traffic incoming from 10.1.1.0 / 24. Router R12 determines to forward the SAV message to router R13, and router R12 designates its interface with R13 as valid for the same source prefix. Subsequently, router R13 forwards the SAV message to router R15 and designates its interface with R15 as valid. When router R15 receives the SAV message, it forwards the message to router R17 and designates its interface as valid for R17. Finally, router R17 identifies itself as the destination router, processes the SAV message, creates a source address verification rule, specifies that it is valid for traffic coming from 10.1.1.0 / 24, and transmits the traffic to 10.7.0.0 / 16. In this way, the SAV message reaches routers R12, R13, R15, and R17, which can create corresponding SAV rules based on SR-policy and subsequently verify the source address of the data packet based on the SAV rules.

[0112] The following specific embodiments are listed to illustrate the message propagation method provided in the embodiments of the present disclosure. Assume that an enterprise network topology is as follows Figure 4 As shown, routers R41, R42, R43, R44, R45, and R46 are included, and SR-policy rules are used to define message transmission paths and interface policies.

[0113] The SR-policy rules are as follows:

[0114] SR-policy of headend router R41: <10.1.1.0 / 24,other,[R41,R43,R45]>

[0115] SR-policy of headend router R42: <*,other,[R42,R45,R46]>

[0116] according to Figure 4 As shown in the enterprise network topology diagram, the message propagation method of the embodiment of the present disclosure includes the following steps.

[0117] (1) Message generation and forwarding process.

[0118] The headend router R41 generates a SAV message with the following fields:

[0119] MT: SRP (based on SR-policy);

[0120] SR: R41;

[0121] NR: R43;

[0122] SP: 10.1.1.0 / 24;

[0123] SID_list:[R41,R43,R45];

[0124] SEC and QoS: set according to SR-policy.

[0125] (2)Message forwarding.

[0126] Router R43 receives the SAV message forwarded by the headend router R41, checks the forwarding path defined by the SR-policy, determines that it is a key node, updates NR to R45, updates SID_list to [R45], and forwards the SAV message to router R45.

[0127] Router R45 receives the SAV message, checks the forwarding path defined by the SR-policy, determines that it is a key node, and forwards the SAV message to the next hop.

[0128] The message is forwarded from R41 to R43, where R43 is not a direct neighbor of R41. Then the message is forwarded from R41 to R42. Since R42 does not match the SID_list in the SAV message, R42 will neither process the message nor create SAV rules based on SR-policy on the router receiving node. Instead, it will flood the message to find the next hop node specified by the SR-policy path, that is, the next key node. Similarly, in the SID_list path with R42 as the head node, R41, R43, and R44 will not process or create SAV rules based on SR-policy when they receive the SAV message forwarded from R42.

[0129] (3) Interface strategy.

[0130] When receiving the SAV message, routers R43 and R45 create SAV rules on the corresponding receiving nodes according to the SR-policy received by R41. Since R42, R44, and R46 are not in the path, there is no need to create SAV rules according to the SR-policy received by R41.

[0131] The message propagation method provided by the embodiment of the present disclosure provides a source address verification message propagation mechanism based on the segment routing policy. The head-end router parses the SR-policy issued by the controller to obtain a target segment list, which is composed of ordered segment identifiers and is used to define the forwarding path. The head-end router generates a SAV message based on the SR-policy, and propagates the SAV message according to the forwarding path defined by the target segment list. It can be seen that this method can guide the SAV message by defining a clear path, and ensure that the SAV message is propagated efficiently, safely, and accurately, so that the routers on the forwarding path can create corresponding SAV rules based on the SR-policy, and can subsequently guide the routers to verify the source address of the data packet according to the SAV rules.

[0132] In addition, the headend router can dynamically adjust the segment list according to the network status and traffic, thereby optimizing the message propagation path and improving the robustness and adaptability of the network; through the flexible definition of the segment list, the message propagation path can be controlled more finely, ensuring that the message reaches all relevant nodes along the optimal path, and ensuring that corresponding SAV rules are created on all router receiving nodes along the way, avoiding the one-sidedness of creating SAV rules based solely on RIB and PBR; using SR-policy can achieve policy-based security and service quality control, and by introducing specific security nodes and service nodes in the segment list, ensure that the propagation of messages meets the security and service quality requirements of the network.

[0133] Figure 5 FIG. 2 shows a schematic diagram of a message transmission device according to an embodiment of the present disclosure. Figure 5 As shown, the message propagation device 500 includes a policy parsing unit 510 , a message generating unit 520 and a forwarding unit 530 .

[0134] The policy parsing unit 510 is configured to: parse the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path. The message generating unit 520 is configured to: generate a source address verification message based on the segment routing policy. The forwarding unit 530 is configured to: forward the source address verification message according to the forwarding path.

[0135] In some embodiments of the present disclosure, the forwarding unit 530 is further configured to forward the source address verification message to other routers according to the forwarding path, so that the other routers create source address verification rules at the receiving interface after receiving the source address verification message.

[0136] In some embodiments of the present disclosure, the source address verification message includes: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; the message type field is used to identify the type of the message; the source router field is used to identify the identifier of the source router; the neighbor router field is used to identify the identifier of the neighbor router; the source prefix field is used to identify the source prefix; the segment list field is used to identify the segment list defined by the segment routing policy.

[0137] In some embodiments of the present disclosure, the source address verification message also includes one or more of a security level field and a quality of service field; the security level field is used to indicate security requirements; and the quality of service field is used to indicate quality of service requirements.

[0138] In some embodiments of the present disclosure, the message generation unit 520 is also configured to: if the segment routing policy includes a source prefix, set the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; and set the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0139] In some embodiments of the present disclosure, the message generation unit 520 is also configured to: if the segment routing policy does not include a source prefix, according to the local traffic control policy, set the value of the source prefix field in the source address verification message to a default value; and set the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0140] In some embodiments of the present disclosure, the message generation unit 520 is also configured to: determine the value of the security level field in the source address verification message according to the security requirements in the segment routing policy; determine the value of the service quality field in the source address verification message according to the service quality requirements in the segment routing policy.

[0141] In some embodiments of the present disclosure, the source address verification rule includes: a source prefix field and a valid interface list field; the source prefix field is used to identify the source prefix; the valid interface list is used to identify the router interface that can receive data packets from the specified source prefix.

[0142] In some embodiments of the present disclosure, the source address verification rule also includes one or more of a security level field and a quality of service field; the security level field is used to identify a policy for processing data packets that do not comply with the rules; and the quality of service field is used to identify quality of service requirements related to data packet processing.

[0143] In some embodiments of the present disclosure, the segment routing strategy includes an optional segment list, which is used to define an alternative path; the message generation unit 520 is also configured to: if the forwarding path is interrupted or an unreachable node appears, update the source address verification message according to the alternative path to obtain a new source address verification message; the forwarding unit 530 is also configured to: propagate the new source address verification message according to the alternative path.

[0144] In some embodiments of the present disclosure, the policy parsing unit 510 is further configured to: identify specific nodes, wherein the specific nodes include load balancing nodes and traffic monitoring nodes; insert the specific nodes into the target segment list, and adjust the node order and number of nodes in the target segment list.

[0145] In some embodiments of the present disclosure, the target segment list includes security nodes and service nodes.

[0146] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the first forwarding unit 530 is further configured to: obtain the multiple forwarding paths, and propagate the message on the multiple forwarding paths in parallel.

[0147] Figure 6 FIG. 2 shows a schematic diagram of a message transmission device according to another embodiment of the present disclosure. Figure 6 As shown, the message propagation device 600 includes a matching unit 610 , a message processing unit 620 and a message flooding unit 630 .

[0148] The matching unit 610 is configured to: receive a source address verification message, and search and match the segment list in the source address verification message with one or more segment lists configured locally; the source address verification message is generated based on the segment routing policy, and the one or more segment lists configured locally are used to identify the role of the forwarding router in the segment routing network. The message processing unit 620 is configured to: if there is a match, process the source address verification message. The message flooding unit 630 is configured to: if there is no match, flood the source address verification message.

[0149] In some embodiments of the present disclosure, the message flooding unit 630 is further configured to: if the forwarding router fails to find the next hop node indicated by the neighbor router field in the source address verification message when forwarding the source address verification message, flood the source address verification message to all adjacent routers.

[0150] In some embodiments of the present disclosure, the message processing unit 620 is also configured to: process the source address verification message, identify the interface receiving the source address verification message as a valid interface, create a source address verification rule, and forward the source address verification message to the next hop node according to the segment list in the source address verification message.

[0151] In some embodiments of the present disclosure, the message processing unit 620 is further configured to: if there is a match, update the value of the neighbor node field in the source address verification message to the identifier of the next hop node in the forwarding path defined by the segment routing policy.

[0152] In some embodiments of the present disclosure, the message processing unit 620 is further configured to: if a match occurs, update the segment list in the source address verification message so that the segment identifier of the next hop node becomes the current segment identifier of the segment list.

[0153] Since the principle of solving the problem in the message propagation device embodiment is similar to that in the above method embodiment, the implementation of the message propagation device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0154] Figure 7 FIG. 1 shows a structural block diagram of an electronic device in an embodiment of the present disclosure. It should be noted that: Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0155] like Figure 7 As shown, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage portion 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0156] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0157] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 709, and / or installed from a removable medium 711. When the computer program is executed by a central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present disclosure are executed.

[0158] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, terminal device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, a terminal device or a device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, a terminal device or a device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0159] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0160] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a policy parsing unit, a message generating unit and a forwarding unit. The names of these units do not constitute a limitation on the units themselves in some cases, for example, the policy parsing unit may also be described as "a unit for parsing the segment routing policy sent by the controller and obtaining a target segment list".

[0161] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or may exist independently without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the following embodiments. For example, the electronic device may implement the following Figure 2 The steps shown.

[0162] According to one aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in various optional implementations of the above-mentioned embodiments.

[0163] It should be understood that any number of elements in the drawings of the present disclosure is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0164] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0165] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A message propagation method, characterized in that: The method comprises: The head-end router parses the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path; The head-end router generates a source address verification message based on the segment routing policy; The head-end router forwards the source address verification message according to the forwarding path.

2. The method according to claim 1, characterized in that The method further comprises: The head-end router forwards the source address verification message to other routers according to the forwarding path, so that the other routers create source address verification rules at the receiving interface after receiving the source address verification message.

3. The method according to claim 1, characterized in that The source address verification message includes: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; The message type field is used to identify the type of message; The source router field is used to identify an identifier of a source router; The neighbor router field is used to identify the identifier of the neighbor router; The source prefix field is used to identify the source prefix; The segment list field is used to identify the segment list defined by the segment routing policy.

4. The method according to claim 3, characterized in that The source address verification message also includes one or more of a security level field and a quality of service field; The security level field is used to indicate security requirements; The Quality of Service field is used to indicate the quality of service requirement.

5. The method according to claim 3, characterized in that: The head-end router generates a source address verification message based on the segment routing strategy, including: If the segment routing policy includes a source prefix, the headend router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; The head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

6. The method according to claim 3, characterized in that: The head-end router generates a source address verification message based on the segment routing strategy, including: If the segment routing policy does not include a source prefix, the headend router sets the value of the source prefix field in the source address verification message to a default value according to a local traffic control policy; The head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

7. The method according to claim 4, characterized in that The head-end router generates a source address verification message based on the segment routing strategy, including: The head-end router determines, according to the security requirements in the segment routing policy, a value of the security level field in the source address verification message; The head-end router determines a value of the quality of service field in the source address verification message according to the quality of service requirement in the segment routing policy.

8. The method according to claim 2, characterized in that: The source address verification rule includes: a source prefix field and a valid interface list field; The source prefix field is used to identify the source prefix; The valid interface list is used to identify router interfaces that can receive data packets from a specified source prefix.

9. The method according to claim 8, characterized in that The source address validation rule also includes one or more of a security level field and a quality of service field; The security level field is used to identify a policy for processing packets that do not comply with the rules; The quality of service field is used to identify the quality of service requirement related to data packet processing.

10. The method according to claim 1, characterized in that The segment routing strategy includes an optional segment list, wherein the optional segment list is used to define an alternative path; The method further comprises: If the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path to obtain a new source address verification message; The head-end router propagates the new source address verification message according to the alternative path.

11. The method according to claim 1, characterized in that: If the target segment list defines multiple forwarding paths, the method further includes: The head-end router obtains the multiple forwarding paths and propagates messages in parallel on the multiple forwarding paths.

12. A message propagation method, characterized in that: The method comprises: The forwarding router receives the source address verification message, and searches and matches the segment list in the source address verification message with one or more segment identifiers configured locally; the source address verification message is generated based on the segment routing policy, and the one or more segment identifiers configured locally are used to identify the role of the forwarding router in the segment routing network; If there is a match, the forwarding router processes the source address verification message; If there is no match, the forwarding router does not process the source address verification message and floods the source address verification message.

13. The method according to claim 12, characterized in that The forwarding router floods the source address verification message, including: If the forwarding router fails to find the next hop node indicated by the neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

14. The method according to claim 12, characterized in that The forwarding router processes the source address verification message, including: The forwarding router processes the source address verification message, identifies the interface receiving the source address verification message as a valid interface, creates a source address verification rule, and forwards the source address verification message to a next hop node according to a segment list in the source address verification message.

15. The method according to claim 14, characterized in that The method further comprises: If there is a match, the forwarding router updates the value of the neighbor node field in the source address verification message to the identifier of the next hop node in the forwarding path defined by the segment routing policy.

16. The method according to claim 14, characterized in that The method further comprises: If there is a match, the forwarding router updates the segment list in the source address verification message so that the segment identifier of the next hop node becomes the current segment identifier of the segment list.

17. A message dissemination device, characterized in that: The device comprises: a policy parsing unit, configured to parse the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path; a message generating unit configured to generate a source address verification message based on the segment routing policy; The forwarding unit is configured to forward the source address verification message according to the forwarding path.

18. A message dissemination device, characterized in that: The device comprises: a matching unit configured to receive a source address verification message, and search and match a segment list in the source address verification message with one or more segment lists configured locally; the source address verification message is generated based on a segment routing policy, and the one or more segment lists configured locally are used to identify the role of the forwarding router in the segment routing network; a message processing unit, configured to process the source address verification message if a match is found; The message flooding unit is configured to flood the source address verification message if there is no match.

19. An electronic device, characterized in that: include: one or more processors; A storage device configured to store one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the message propagation method as described in any one of claims 1 to 11, or to implement the message propagation method as described in any one of claims 12 to 16.

20. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the message propagation method according to any one of claims 1 to 11 is implemented, or the message propagation method according to any one of claims 12 to 16 is implemented.

21. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the message propagation method according to any one of claims 1 to 11, or implements the message propagation method according to any one of claims 12 to 16.

Images