Message sending method and device based on routing security verification, and storage medium

Abstract

The invention provides a message sending method and device based on routing security verification and a storage medium, relates to the technical field of networks, and solves the technical problem that routing security verification of routing equipment based on a routing forwarding rule designed by a valley-free model is possibly not comprehensive enough in the related technology. The method is applied to first routing equipment and comprises the following steps: receiving a target message sent by second routing equipment; the second routing device is a previous hop device of the first routing device; the target message comprises a network domain identifier of the second routing device; the network domain identifier is used for indicating a network domain to which the routing equipment belongs; performing routing security verification on the first routing equipment based on the network domain identifier of the second routing equipment and the network domain identifier of the first routing equipment; and under the condition that the routing security verification of the first routing device is passed, the target message is sent to a third routing device, and the third routing device is a next hop device of the first routing device.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a message sending method, device and storage medium based on routing security verification. Background Art

[0002] In a communication network, a network message needs to pass through a transmission link before it can reach its destination. There are a large number of routing devices in the transmission link as intermediate nodes of network messages. Routing devices forward network messages to complete the transmission of network messages. However, network messages forwarded by routing devices may have security risks. Therefore, routing devices need to perform routing security verification on network messages to be forwarded, and forward the network messages only after the network messages pass the routing security verification.

[0003] Currently, routing devices can complete routing security verification and forwarding of network messages based on routing forwarding rules designed based on a valley-free model.

[0004] However, in the related art, the routing forwarding rules designed by the routing device based on the valley-free model may not be comprehensive enough for the routing security verification of network messages, there are certain security risks, and the security and reliability of message sending cannot be guaranteed. Summary of the invention

[0005] The present application provides a message sending method, device and storage medium based on routing security verification, which solves the technical problem in the related art that the routing forwarding rules designed by the routing device based on the valley-free model may not be comprehensive enough for the routing security verification of network messages.

[0006] In a first aspect, the present application provides a message sending method based on routing security verification, which is applied to a first routing device, the method comprising: receiving a target message sent by a second routing device; the second routing device is a previous-hop device of the first routing device; the target message comprises: a network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, performing routing security verification on the first routing device; if the routing security verification of the first routing device passes, sending the target message to a third routing device, the third routing device being the next-hop device of the first routing device.

[0007] In the present application, the network domain identifier of the second routing device is the same as or different from the network domain identifier of the first routing device, and the content of the verification when performing routing security verification on the first routing device is different. Therefore, based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device can be reliably and accurately performed. If the routing security verification of the first routing device passes, it means that the target message will not bring security risks to the next-hop routing device of the first routing device. At this time, the first routing device sends the target message to the third routing device. In this way, while ensuring the security of the device, the transmission of the target message is completed, and the business service corresponding to the target message is reliably and securely implemented. The network domain identifier of the second routing device and the network domain identifier of the first routing device are used to verify the routing security of the first routing device. If the routing security verification of the first routing device passes, the target message is sent to the third routing device, thereby ensuring the security and reliability of the message sending process.

[0008] Optionally, the routing security verification is performed on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, including: if the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, intra-domain routing security verification is performed on the first routing device; if the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, cross-domain routing security verification is performed on the first routing device.

[0009] In the present application, the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, indicating that the first routing device and the second routing device belong to the same network domain. In this case, intra-domain routing security verification is performed on the first routing device. The network domain identifier of the second routing device is different from the network domain identifier of the first routing device, indicating that the first routing device and the second routing device belong to different network domains. In this case, cross-domain routing security verification is performed on the first routing device.

[0010] Optionally, the target message also includes a network level of a historical routing device, the historical routing device being the routing device that the target message passes through before the first routing device, and the network level being the level at which the routing device is located in the network topology structure of the communication network; if the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, then performing intra-domain routing security verification on the first routing device, including: if the second routing device is not the highest-level routing device among the historical routing devices, and the network level of the first routing device is lower than that of the second routing device, then determining that the routing security verification of the first routing device has passed; or, if the second routing device is the highest-level routing device among the historical routing devices, then determining that the routing security verification of the first routing device has passed.

[0011] In the present application, the second routing device is not the highest-level routing device in the historical routing devices, and the network level of the first routing device is lower than that of the second routing device, indicating that the target message passes through the highest network level routing device in the transmission link during the transmission process, and the target message is transmitted downstream during the transmission from the second routing device to the first routing device. At this time, it is determined that the routing security verification of the first routing device has passed. In this way, it can be ensured that the target message will not be cyclically routed during the transmission process, that is, the target message will not circulate infinitely in the network, thereby avoiding the occurrence of problems such as resource waste, infinite loops and broadcast storms, ensuring the reliability and effectiveness of message transmission, and ensuring the stability of the communication network. The second routing device is the highest-level routing device in the historical routing devices, indicating that the target message is being transmitted upstream or has just begun to be transmitted downstream or is being transmitted at the same level. At this time, it is not necessary to judge the high-low relationship between the network levels of the first routing device and the second routing device, and directly determine that the routing security verification of the first routing device has passed, thus ensuring the normal transmission of the target message.

[0012] Optionally, if the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, a cross-domain routing security verification is performed on the first routing device, including: if the network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device, determining that the routing security verification of the first routing device has passed.

[0013] In the present application, the trusted network domain identifier of the first routing device includes all network domain identifiers trusted by the network domain to which the first routing device belongs. The network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device, indicating that the network domain to which the second routing device belongs is a trusted network domain of the network domain to which the first routing device belongs. At this time, it is determined that the routing security verification of the target message has passed. In this way, the security and reliability of the target message when it is transmitted across network domains can be guaranteed.

[0014] Optionally, the target message also includes a service security identifier corresponding to the target message; the service security identifier is used to indicate whether the service corresponding to the target message is a target service, and the security requirement level of the target service is higher than the service with a preset security requirement level; the target message is sent to the third routing device when the routing security verification of the first routing device passes, including: when the routing security verification of the target message passes and the service security identifier is used to indicate that the service corresponding to the target message is the target service, obtaining the device identifier of the third routing device; if the device identifier of the third routing device belongs to the trusted device identifier corresponding to the target service, sending the target message to the third routing device.

[0015] In this application, the routing security verification of the first routing device is passed, and the business security identifier is used to indicate that the business corresponding to the target message is the target business, indicating that the security requirements of the business corresponding to the target message are relatively high. At this time, it is necessary to check whether the third routing device is trustworthy. The device identifier of the third routing device belongs to the trusted device identifier corresponding to the target business, indicating that the third routing device is a trusted device corresponding to the target business. At this time, the first routing device sends the target message to the third routing device. In this way, it can be ensured that the information in the target message will not be obtained by untrusted devices, ensuring the privacy of the target message.

[0016] Optionally, the target message also includes a source routing device corresponding to the target message; the source routing device is the first routing device in the transmission link of the target message; the method also includes: when the routing security verification of the first routing device fails, sending a routing abnormality prompt message to the second routing device, and the destination routing device of the routing abnormality prompt message is the source routing device.

[0017] In this application, if the routing security verification of the first routing device fails, it means that there is a security risk in the target message, and a routing prompt message is sent to the second routing device. In this way, the terminal or user who needs to send the target message can determine that the target message has not been sent successfully, so that further operations can be taken to ensure the reliability of the business corresponding to the target message and the user's service experience.

[0018] In a second aspect, the present application provides a message sending device for routing security verification, which is applied to a first routing device, and the device includes a receiving module, a processing module and a sending module: the receiving module is used to receive a target message sent by a second routing device; the second routing device is a previous hop device of the first routing device; the target message includes: a network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; the processing module is used to perform routing security verification on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device; the sending module is used to send the target message to a third routing device when the routing security verification of the first routing device passes, and the third routing device is the next hop device of the first routing device.

[0019] Optionally, the processing module is specifically used to perform intra-domain routing security verification on the first routing device if the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device; the processing module is also specifically used to perform cross-domain routing security verification on the first routing device if the network domain identifier of the second routing device is different from the network domain identifier of the first routing device.

[0020] Optionally, the target message also includes a network level of a historical routing device, the historical routing device being a routing device that the target message passes before the first routing device, and the network level being the level at which the routing device is located in the network topology structure of the communication network; the apparatus also includes a determination module; the determination module is further used to determine that the routing security verification of the first routing device has passed if the second routing device is not the highest-level routing device among the historical routing devices, and the network level of the first routing device is lower than that of the second routing device; the determination module is further used to determine that the routing security verification of the first routing device has passed if the second routing device is the highest-level routing device among the historical routing devices.

[0021] Optionally, the determination module is further configured to determine that the routing security verification of the first routing device has passed if the network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device.

[0022] Optionally, the target message also includes a service security identifier corresponding to the target message; the service security identifier is used to indicate whether the service corresponding to the target message is a target service, and the security requirement level of the target service is higher than the service with a preset security requirement level; the device also includes an acquisition module; the acquisition module is used to acquire the device identifier of the third routing device when the routing security verification of the target message is passed and the service security identifier is used to indicate that the service corresponding to the target message is the target service; the sending module is also used to send the target message to the third routing device if the device identifier of the third routing device belongs to the trusted device identifier corresponding to the target service.

[0023] Optionally, the target message also includes a source routing device corresponding to the target message; the source routing device is the first routing device in the transmission link of the target message; the sending module is also used to send a routing exception prompt message to the second routing device when the routing security verification of the first routing device fails, and the destination routing device of the routing exception prompt message is the source routing device.

[0024] In a third aspect, the present application provides a message sending device based on routing security verification, comprising: a processor and a memory configured to store processor executable instructions; wherein the processor is configured to execute the instructions to implement any one of the optional methods in the above-mentioned first aspect.

[0025] In a fourth aspect, the present application provides a computer-readable storage medium having instructions stored thereon. When the instructions in the computer-readable storage medium are executed by a message sending device based on routing security verification, the message sending device based on routing security verification can execute any one of the optional methods in the above-mentioned first aspect.

[0026] In a fifth aspect, the present application provides a computer program product, which includes computer technology program instructions, and when the computer program instructions are executed by a processor, any optional method in the above-mentioned first aspect is implemented.

[0027] The present application provides a method, device and storage medium for sending a message based on routing security verification, the method comprising: receiving a target message sent by a second routing device; the second routing device is the previous hop device of the first routing device; the target message includes: the network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device is performed; if the routing security verification of the first routing device passes, the target message is sent to a third routing device, the third routing device is the next hop device of the first routing device. The network domain identifier of the second routing device is the same as or different from the network domain identifier of the first routing device, and the content of the verification when the routing security verification of the first routing device is performed is different. Therefore, based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device can be reliably and accurately performed. If the routing security verification of the first routing device passes, it means that the target message will not bring security risks to the next hop routing device of the first routing device. At this time, the first routing device sends the target message to the third routing device. In this way, the target message is transmitted while ensuring the security of the device, and the business service corresponding to the target message is realized reliably and securely. The first routing device is verified during the routing security verification through the network domain identifier of the second routing device and the network domain identifier of the first routing device. If the routing security verification of the first routing device passes, the target message is sent to the third routing device, ensuring the security and reliability of the message sending process. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0029] Figure 1 A schematic diagram of a network architecture of a message sending system provided in an embodiment of the present application;

[0030] Figure 2 A schematic diagram of the structure of a routing device provided in an embodiment of the present application;

[0031] Figure 3 A flowchart of a message sending method based on routing security verification provided in an embodiment of the present application;

[0032] Figure 4A flowchart of another message sending method based on routing security verification provided in an embodiment of the present application;

[0033] Figure 5 A schematic diagram of the structure of a message sending device based on routing security verification provided in an embodiment of the present application;

[0034] Figure 6 A schematic diagram of the structure of another message sending device based on routing security verification provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The following will describe in detail the message sending method, device and storage medium based on routing security verification provided by the embodiments of the present application in conjunction with the accompanying drawings.

[0036] The terms "first" and "second" in the specification and drawings of this application are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first routing device and a second routing device are used to distinguish different routing devices rather than to describe a specific order of the routing devices.

[0037] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0038] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0039] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0040] In a communication network, a network message needs to pass through a transmission link before it can reach its destination. There are a large number of routing devices in the transmission link as intermediate nodes of network messages. Routing devices forward network messages to complete the transmission of network messages. However, network messages forwarded by routing devices may have security risks. Therefore, routing devices need to perform routing security verification on network messages to be forwarded, and forward the network messages only after the network messages pass the routing security verification.

[0041] Currently, routing devices can complete routing security verification and forwarding of network messages based on routing forwarding rules designed based on the valley-free model.

[0042] However, in the related art, the routing forwarding rules designed by the routing device based on the valley-free model may not be comprehensive enough for the routing security verification of network messages, there are certain security risks, and the security and reliability of message sending cannot be guaranteed.

[0043] Based on this, the embodiment of the present application provides a message sending method, apparatus, device, storage medium and program product based on routing security verification, receiving a target message sent by a second routing device; the second routing device is the previous hop device of the first routing device; the target message includes: the network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device is performed; if the routing security verification of the first routing device passes, the target message is sent to a third routing device, and the third routing device is the next hop device of the first routing device. The network domain identifier of the second routing device is the same as or different from the network domain identifier of the first routing device, and the content of the verification when the routing security verification of the first routing device is performed is different. Therefore, based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device can be reliably and accurately performed. The routing security verification of the first routing device passes, indicating that the target message will not bring security risks to the next hop routing device of the first routing device. At this time, the first routing device sends the target message to the third routing device. In this way, the target message is transmitted while ensuring the security of the device, and the business service corresponding to the target message is realized reliably and securely. The first routing device is verified during the routing security verification through the network domain identifier of the second routing device and the network domain identifier of the first routing device. If the routing security verification of the first routing device passes, the target message is sent to the third routing device, ensuring the security and reliability of the message sending process.

[0044] The message sending method, device and storage medium based on routing security verification provided by the embodiments of the present application can be applied to a message sending system, such as Figure 1 As shown, the message sending system includes a terminal 101, a first routing device 102, a second routing device 103, a third routing device 104 and a target terminal 105. Generally, in practical applications, the connection between the above-mentioned devices can be a wireless connection. In order to conveniently and intuitively represent the connection relationship between the devices, Figure 1 Solid lines are used to indicate.

[0045] The terminal 101 is used to send a target message to the second routing device 102, where the target message includes a transmission link of the target message.

[0046] The first routing device 102 is used to receive the target message sent by the second routing device 103, and if the target message meets the preset forwarding rule, send the target message to the third routing device 104. The second routing device 103 is the previous hop device of the first routing device 102, and the third routing device 104 is the next hop device of the first routing device 102.

[0047] The second routing device 103 is configured to receive a target message sent by the terminal 101 and send the target message to the first routing device.

[0048] The third routing device 104 is configured to receive a target message sent by the third routing device 104 , and send the target message to the target terminal 105 .

[0049] The target terminal 105 is used to receive the target message sent by the third routing device 104. The target terminal 105 is the end point device of the transmission link in the target message.

[0050] Exemplarily, the terminal 101 or the target terminal 105 may be a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) or a virtual reality (VR) device. The embodiment of the present application does not impose any special restrictions on the specific form of the electronic device. It can interact with the user through one or more methods such as a keyboard, a touchpad, a touch screen, a remote control, voice interaction or a handwriting device.

[0051] Exemplarily, the first routing device 102, the second routing device 103 or the third routing device 104 implementing the embodiment of the present application may be any network device capable of implementing functions such as addressing, path selection, and flow control.

[0052] like Figure 2 As shown, the first routing device 102, the second routing device 103 or the third routing device 104 may include an intrinsic security identification module, a security path database module, a pre-classification module and a security verification module.

[0053] The intrinsic security identification module is used to store the unique intrinsic security identification of the routing device (or routing transmission node, router). The unique intrinsic security identification includes: network domain identification, network level identification, and device identification.

[0054] In some embodiments, the network domain identifier may be referred to as a home security domain feature; the network level identifier may be referred to as a network level feature; and the device identifier may be referred to as a physical security feature. The home security domain feature is used to characterize the network domain to which the routing device belongs. The network level feature is used to indicate the network level to which the routing device belongs. The physical security feature is used to indicate the physical features of the routing device.

[0055] Exemplarily, the unique intrinsic security identifier is I SAFE_i =(A i ,L i ,S i ), A i is the attribute security domain feature, L i is the network-level feature, S i A physical security feature.

[0056] The secure path database module includes a routing secure path rule base, which is used to store and maintain secure path rules within and between domains. The secure path rules within a domain are trusted transmission rules within the domain, and the secure path rules between domains are secure trust relationships between domains.

[0057] In some embodiments, the trusted transmission rules are obtained based on the network topology and the neighbor relationship of the routing nodes. The trusted transmission rules include forwarding rules corresponding to the network layer of the routing device (exemplarily, after the message passes through the highest network layer of the transmission link, the message is transferred downstream and not upstream).

[0058] In some embodiments, the secure trust relationship is based on a business relationship and a trust access relationship between the routing devices.

[0059] Optionally, the security trust relationship may be stored in an inter-domain security path database.

[0060] Optionally, the inter-domain security path database may be deployed only on a global routing security verification node, wherein the global routing security verification node is a border routing device between network domains.

[0061] The pre-classification module is used to perform domain classification of routing paths based on security domain characteristics and network layer characteristics, and determine whether to perform intra-domain security path verification or cross-domain security path verification.

[0062] The security verification module of each routing transmission node verifies the security of the intra-domain routing, and the security verification module of the global routing security verification node verifies the security of the inter-domain routing. The security path rule database is called to verify the security of the routing path.

[0063] like Figure 3 As shown, the message sending method based on routing security verification provided in the embodiment of the present application may include S301-S303:

[0064] S301: Receive a target message sent by a second routing device.

[0065] The second routing device is the previous hop device of the first routing device. The target message includes: a network domain identifier of the second routing device. The network domain identifier is used to indicate the network domain to which the routing device belongs.

[0066] Optionally, the network domain identifier may be in a numeric format.

[0067] In a possible implementation manner, the second routing device may send a target message to the first routing device.

[0068] It should be understood that the network domain identifier may represent a lateral feature of a routing device in a communication network.

[0069] In some embodiments, the network domain identification may be referred to as a home domain feature.

[0070] In some embodiments, there may be multiple network domains in the communication network, and the multiple network domains may be in parallel or subordinate relationship.

[0071] Exemplarily, it is assumed that there are a first network domain, a second network domain, a third network domain, and a fourth network domain, wherein the second network domain is subordinate to the first network domain, the fourth network domain is subordinate to the third network domain, and the first network domain and the third network domain are in a parallel relationship.

[0072] S302: Based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, perform routing security verification on the first routing device.

[0073] It should be understood that if the first routing device and the second routing device belong to different network domains, the manner of performing routing security verification on the first routing device will be different.

[0074] In a possible implementation, the message type is an intra-domain message or a cross-domain message. Figure 3 ,like Figure 4 As shown, the above S302, based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, performs routing security verification on the first routing device, includes S401-S402:

[0075] S401: If the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, perform intra-domain routing security verification on the first routing device.

[0076] It should be understood that the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, indicating that the first routing device and the second routing device belong to the same network domain. At this time, intra-domain routing security verification is performed on the first routing device.

[0077] In some embodiments, the target message also includes a network level of a historical routing device, where the historical routing device is a routing device that the target message passes through before the first routing device, and the network level is the level at which the routing device is located in the network topology structure of the communication network.

[0078] In some embodiments, the network level of a routing device may be used to indicate the role of the routing device in the network topology.

[0079] Exemplarily, the network levels of the routing device may include: a first level, a second level, and a third level. The first level is higher than the second level. The second level is higher than the third level.

[0080] Exemplarily, the network level of the routing device may include at least one of the following: access layer, aggregation layer, core layer, boundary layer, backbone layer. The network levels of access layer, aggregation layer, core layer, boundary layer, backbone layer are increased in sequence.

[0081] In some embodiments, the network level of the routing device may include at least one of the following: a customer level and a service provider level. The customer level is lower than the service provider level.

[0082] In some embodiments, the customer layer and / or the service provider layer may further include multiple levels.

[0083] Exemplarily, it is assumed that the customer layer includes a primary customer layer and a secondary customer layer; the primary customer layer is higher in level than the secondary customer layer.

[0084] In a possible implementation, if the second routing device is not the highest-level routing device among the historical routing devices, and the network level of the first routing device is lower than that of the second routing device, it is determined that the routing security verification of the first routing device has passed. Alternatively, if the second routing device is the highest-level routing device among the historical routing devices, it is determined that the routing security verification of the first routing device has passed.

[0085] It should be understood that the second routing device is not the highest-level routing device among the historical routing devices, and the network level of the first routing device is lower than that of the second routing device, which means that the target message passes through the highest-level routing device in the transmission link during the transmission process, and the target message is transmitted downstream during the transmission from the second routing device to the first routing device. At this time, it is determined that the routing security verification of the first routing device has passed. In this way, it can be ensured that the target message will not be circularly routed during the transmission process, that is, the target message will not circulate infinitely in the network, thereby avoiding the occurrence of problems such as waste of resources, infinite loops, and broadcast storms, ensuring the reliability and effectiveness of message transmission, and ensuring the stability of the communication network.

[0086] Exemplarily, assume that the historical routing device includes device A, device B, device C, and a second routing device. The target message passes through device A, device B, and device C in sequence and reaches the second routing device. Device B has the highest network level. At this time, the target message passes through device A to reach device B, which is a process of upstream transmission, and the target message passes through devices B and device C to reach the second routing device, which is a process of downstream transmission. Therefore, the second routing device is not the highest-level routing device among the historical routing devices, which means that the target message has begun to turn to downstream transmission in the process of passing through the historical routing device. At this time, the network level relationship between the second routing device and the first routing device is determined. When the network level of the first routing device is lower than that of the second routing device, it means that the target message continues to be transmitted downstream through the first routing device, and will not cause the message to loop infinitely in the network. At this time, it is determined that the routing security verification of the first routing device has passed.

[0087] It can be understood that the second routing device is the highest-level routing device among the historical routing devices, which means that the target message is being transmitted upstream or has just started to be transmitted downstream or is being transmitted at the same level. At this time, there is no need to judge the high-low relationship between the network levels between the first routing device and the second routing device. It is directly determined that the routing security verification of the first routing device has passed, thereby ensuring the normal transmission of the target message.

[0088] Exemplarily, it is assumed that the routing device includes device A, device B, device C, and a second routing device. The target message passes through device A, device B, device C in sequence and reaches the second routing device. The second routing device has the highest network level. At this time, when the target message reaches the second routing device, it has not yet started to be transmitted downstream. Therefore, no matter whether the network level of the first routing device is the same as that of the second routing device, lower than the second routing device, or higher than the second routing device, there will be no problem of the target message turning downstream and then transmitting upstream. Therefore, when the second routing device is the highest-level routing device in the historical routing device, it is directly determined that the routing security verification of the first routing device has passed.

[0089] S402: If the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, perform cross-domain routing security verification on the first routing device.

[0090] It should be understood that the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, indicating that the first routing device and the second routing device belong to different network domains. At this time, cross-domain routing security verification is performed on the first routing device.

[0091] In a possible implementation, if the network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device, it is determined that the routing security verification of the first routing device passes.

[0092] It should be understood that the trusted network domain identifier of the first routing device includes all network domain identifiers trusted by the network domain to which the first routing device belongs. The network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device, indicating that the network domain to which the second routing device belongs is a trusted network domain of the network domain to which the first routing device belongs. At this time, it is determined that the routing security verification of the target message has passed. In this way, the security and reliability of the target message when it is transmitted across network domains can be guaranteed.

[0093] S303: When the routing security verification of the first routing device passes, send a target message to the third routing device.

[0094] The third routing device is a next-hop device of the first routing device.

[0095] It should be understood that the network domain identifier of the second routing device is the same as or different from the network domain identifier of the first routing device, and the content of the verification when performing routing security verification on the first routing device is different. Therefore, based on the network domain identifier of the second routing device and the network domain identifier of the first routing device, the routing security verification of the first routing device can be reliably and accurately performed. The routing security verification of the first routing device passes, indicating that the target message will not bring security risks to the next-hop routing device of the first routing device. At this time, the first routing device sends the target message to the third routing device. In this way, while ensuring the security of the device, the transmission of the target message is completed, and the business service corresponding to the target message is reliably and securely implemented. The network domain identifier of the second routing device and the network domain identifier of the first routing device are used to verify the routing security of the first routing device. When the routing security verification of the first routing device passes, the target message is sent to the third routing device, ensuring the security and reliability of the message sending process.

[0096] In some embodiments, the target message further includes a service security identifier corresponding to the target message. The service security identifier is used to indicate whether the service corresponding to the target message is a target service, and the security requirement level of the target service is higher than the preset security requirement level of the service.

[0097] In a possible implementation, when the routing security verification of the first routing device passes and the service security identifier is used to indicate that the service corresponding to the target message is the target service, the device identifier of the third routing device is obtained. If the device identifier of the third routing device belongs to the trusted device identifier corresponding to the target service, the target message is sent to the third routing device.

[0098] It should be understood that the routing security verification of the first routing device passes, and the service security identifier is used to indicate that the service corresponding to the target message is the target service, indicating that the security requirement of the service corresponding to the target message is high. At this time, it is necessary to verify whether the third routing device is trustworthy.

[0099] It can be understood that the device identification of the third routing device belongs to the trusted device identification corresponding to the target service, indicating that the third routing device is a trusted device corresponding to the target service. At this time, the first routing device sends the target message to the third routing device. In this way, it can be ensured that the information in the target message will not be obtained by untrusted devices, thereby ensuring the privacy of the target message.

[0100] In one possible implementation, if the device identifier of the third routing device does not belong to the trusted device identifier corresponding to the target service, the target message is deleted and a security prompt information is sent to the source device corresponding to the target message (such as the terminal that sends the target message). The security prompt information is used to prompt the source device (or the user corresponding to the source device) that there is an untrusted node in the transmission link of the target message and to use a trusted transmission link.

[0101] In one possible implementation, the device identifier of the third routing device may be referred to as a service security feature or a trusted security capability.

[0102] In some embodiments, the target message also includes a source routing device corresponding to the target message. The source routing device is the first routing device in the transmission link of the target message.

[0103] In a possible implementation, when the routing security verification of the first routing device fails, a routing abnormality prompt message is sent to the second routing device, and the destination routing device of the routing abnormality prompt message is the source routing device.

[0104] It should be understood that if the routing security verification of the first routing device fails, it means that there is a security risk in the first routing device, and an abnormal prompt message is sent to the second routing device. In this way, the terminal or user who needs to send the target message can determine that the target message has not been sent successfully, so that further operations can be taken to ensure the reliability of the business corresponding to the target message and the user's service experience.

[0105] In a possible implementation, the target message received by the first routing device may carry the unique intrinsic security identifier of the second routing device. The target message sent by the first routing device to the third routing device may include the displacement intrinsic security identifier of the first routing device.

[0106] The embodiment of the present application can divide the functional modules of the routing device, terminal, message sending device based on routing security verification, etc. according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0107] In the case of dividing each functional module into corresponding functional modules, Figure 5 A possible structural diagram of a message sending device based on routing security verification involved in the above embodiment is shown. Figure 5 As shown, the message sending device based on routing security verification may include: a receiving module 501 , a processing module 502 and a sending module 503 .

[0108] The receiving module 501 is used to receive a target message sent by a second routing device.

[0109] The second routing device is a previous hop device of the first routing device. The target message includes: a network domain identifier of the second routing device. The network domain identifier is used to indicate the network domain to which the routing device belongs.

[0110] The processing module 502 is configured to perform routing security verification on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device.

[0111] The sending module 503 is used to send the target message to a third routing device when the routing security verification of the first routing device passes, and the third routing device is the next hop device of the first routing device.

[0112] Optionally, the processing module 502 is specifically configured to perform intra-domain routing security verification on the first routing device if the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device.

[0113] The processing module 502 is further specifically configured to perform cross-domain routing security verification on the first routing device if the network domain identifier of the second routing device is different from the network domain identifier of the first routing device.

[0114] Optionally, the target message further includes a network level of a historical routing device, the historical routing device being a routing device that the target message passed before the first routing device, and the network level being a level at which the routing device is located in a network topology structure of the communication network. The apparatus further includes a determination module 504 .

[0115] The determination module 504 is further configured to determine that the routing security verification of the first routing device has passed if the second routing device is not the highest-level routing device in the historical routing devices and the network level of the first routing device is lower than that of the second routing device.

[0116] The determination module 504 is further configured to determine that the routing security verification of the first routing device has passed if the second routing device is the highest-level routing device among the historical routing devices.

[0117] Optionally, the determination module 504 is further configured to determine that the routing security verification of the first routing device has passed if the network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device.

[0118] Optionally, the target message also includes a service security identifier corresponding to the target message. The service security identifier is used to indicate whether the service corresponding to the target message is a target service, and the security requirement level of the target service is higher than the service with a preset security requirement level. The device also includes an acquisition module 505.

[0119] The acquisition module 505 is used to acquire the device identifier of the third routing device when the routing security verification of the target message passes and the service security identifier is used to indicate that the service corresponding to the target message is the target service.

[0120] The sending module 503 is further configured to send the target message to the third routing device if the device identifier of the third routing device belongs to the trusted device identifier corresponding to the target service.

[0121] Optionally, the target message also includes a source routing device corresponding to the target message. The source routing device is the first routing device in the transmission link of the target message.

[0122] The sending module 503 is further configured to send a routing anomaly prompt message to the second routing device when the routing security verification of the first routing device fails, and the destination routing device of the routing anomaly prompt message is the source routing device.

[0123] In the case of an integrated unit, Figure 6 FIG. 2 shows a possible structural diagram of a message sending device based on routing security verification involved in the above embodiment. Figure 6 As shown, the message sending device based on routing security verification may include: a processing module 601 and a communication module 602. The processing module 601 may be used to control and manage the actions of the message sending device based on routing security verification. The communication module 602 may be used to support the communication between the message sending device based on routing security verification and other entities. Optionally, as Figure 6 As shown, the message sending device based on routing security verification may further include a storage module 603 for storing program codes and data of the message sending device based on routing security verification.

[0124] The processing module 601 may be a processor or a controller. The communication module 602 may be a transceiver, a transceiver circuit or a communication interface, etc. The storage module 603 may be a memory.

[0125] When the processing module 601 is a processor, the communication module 602 is a transceiver, and the storage module 603 is a memory, the processor, the transceiver, and the memory can be connected via a bus. The bus can be a PCI bus or an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0126] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0127] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0128] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0129] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or may include one or more servers, data centers and other data storage devices that can be integrated with the medium. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0131] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A message sending method based on routing security verification, characterized in that: Applied to a first routing device, the method includes: receiving a target message sent by a second routing device; the second routing device is a previous hop device of the first routing device; the target message includes: a network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; Performing routing security verification on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device; In the case where the routing security verification of the first routing device passes, the target message is sent to a third routing device, and the third routing device is a next-hop device of the first routing device.

2. The method according to claim 1, characterized in that The performing routing security verification on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device includes: If the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, performing intra-domain routing security verification on the first routing device; If the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, cross-domain routing security verification is performed on the first routing device.

3. The method according to claim 2, characterized in that The target message also includes a network level of a historical routing device, the historical routing device being a routing device that the target message passes through before the first routing device, and the network level being a level at which the routing device is located in a network topology structure of the communication network; If the network domain identifier of the second routing device is the same as the network domain identifier of the first routing device, performing intra-domain routing security verification on the first routing device includes: If the second routing device is not the highest-level routing device among the historical routing devices, and the network level of the first routing device is lower than that of the second routing device, determining that the routing security verification of the first routing device passes; Alternatively, if the second routing device is the highest-level routing device among the historical routing devices, it is determined that the routing security verification of the first routing device passes.

4. The method according to claim 2, characterized in that: If the network domain identifier of the second routing device is different from the network domain identifier of the first routing device, performing cross-domain routing security verification on the first routing device includes: If the network domain identifier of the second routing device belongs to the trusted network domain identifier of the first routing device, it is determined that the routing security verification of the first routing device has passed.

5. The method according to any one of claims 1 to 4, characterized in that The target message also includes the corresponding service security identifier of the target message; the service security identifier is used to indicate whether the service corresponding to the target message is the target service, and the security requirement level of the target service is higher than the service with a preset security requirement level; The sending the target message to the third routing device when the routing security verification of the first routing device passes includes: When the service security identifier is used to indicate that the service corresponding to the target message is the target service, acquiring the device identifier of the third routing device; If the device identifier of the third routing device belongs to the trusted device identifier corresponding to the target service, the target message is sent to the third routing device.

6. The method according to any one of claims 1 to 4, characterized in that The target message also includes a source routing device corresponding to the target message; The source routing device is the first routing device in the transmission link of the target message; the method further includes: In the case that the routing security verification of the first routing device fails, a routing abnormality prompt message is sent to the second routing device, and the destination routing device of the routing abnormality prompt message is the source routing device.

7. A message sending device based on routing security verification, characterized in that: include: Receiving module, processing module and sending module; The receiving module is used to receive a target message sent by the first routing device; The target message includes: a network domain identifier of the second routing device; the network domain identifier is used to indicate the network domain to which the routing device belongs; The processing module is used to perform routing security verification on the first routing device based on the network domain identifier of the second routing device and the network domain identifier of the first routing device; The sending module is used to send the target message to a third routing device when the routing security verification of the first routing device passes, and the third routing device is a next-hop device of the first routing device.

8. A message sending device based on routing security verification, characterized in that: include: processor; a memory configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions in the computer-readable storage medium are executed by a message sending device based on routing security verification, the message sending device based on routing security verification is enabled to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises computer program instructions, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images